01 Record

CVE-2026-9198

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

CriticalKEVPUBLISHEDCNA: ibm

Base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

02 Description

Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Published

2026-07-17 17:36Z28 DAYS AGO

Last updated

2026-08-05 03:56Z9 DAYS AGO

Reserved

2026-05-21

Assigning CNA

ibm

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

SSVC decision

ExploitationactiveAutomatableyesTechnical Impacttotal

KEV catalog

Added 2026-08-04 · remediation due 2026-08-07

Data version

5.2

Document digest

ccbcb6697920e9232824b95a519f31dc1dd076508add684b804be0f9c7bda438

VendorProductVersionsPlatforms

IBMLangflow OSS1.0.0 to 1.10.0—

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.1 https://pypi.org/project/langflow/