A critical vulnerability in IBM's Langflow, a low-code platform for building AI agents, is being actively exploited by attackers, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities catalogue. The flaw allows unauthenticated attackers to remotely execute code on default Langflow deployments, putting any organisation running an unpatched instance at immediate risk. This matters because Langflow has been integrated into IBM's watsonx.ai studio, meaning the exposure could extend beyond standalone installations into wider enterprise AI tooling.

The vulnerability, tracked as CVE-2026-9198, stems from two chained issues in default deployments: an auto-login endpoint that hands out superuser tokens to any network caller, and a code validation endpoint that will execute arbitrary Python code. Together these let an attacker seize control of a Langflow server. IBM says the bug affects Langflow OSS versions 1.0.0 through 1.10.0 and is urging users to upgrade to at least 1.10.1, though the latest release is 1.11.2. The CVE was published on 17 July, and CISA confirmed active exploitation on Tuesday; the scale of the attacks remains unknown.