A security vulnerability has been found in IBM Langflow, a service some of our hosting clients may run on their accounts. This is a code injection flaw, a type of security weakness that lets unauthorized people run their own custom code on an affected system.
This specific issue lets unauthenticated attackers—people who don’t even need a valid login to access the system—gain full remote code execution on default Langflow deployments. In plain terms, this gives an attacker complete control over the server or instance running Langflow, letting them run any commands they want on that service.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-9198
