A critical security vulnerability has been found in IBM Langflow, a tool used by many website and application owners to build and manage custom AI and automation workflows. This is a code injection flaw, which allows unauthenticated attackers (people who do not have login access to your Langflow setup) to run their own code on your server. For default Langflow deployments, this gives attackers full remote control of the affected system, which could let them access your data, modify your workflows, or disrupt the services you run through the platform.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-9198
