A serious security vulnerability has been identified in IBM Langflow, a workflow automation tool that some customers host on their web hosting accounts. The flaw allows unauthenticated attackers (people who do not have a valid login for the Langflow instance) to run any code they choose on default Langflow deployments, giving them full control of the affected system. This level of access could let attackers view, steal, modify, or delete your Langflow data, disrupt your automated workflows, or use your setup to target other users or systems.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-9198
