CVE-2026-9198 affects IBM Langflow OSS versions 1.0.0 through 1.10.0. The vulnerability arises from improper control of code generation (CWE-94), where unauthenticated attackers can chain the /api/v1/auto_login endpoint, which mints SUPERUSER tokens to any network caller, with the /api/v1/validate/code endpoint that executes user-supplied code using exec(). This combination enables full remote code execution on default Langflow OSS deployments without authentication.

Successful exploitation results in full remote code execution with SUPERUSER privileges on affected IBM Langflow OSS deployments. This allows attackers to execute arbitrary commands, potentially leading to complete system compromise, data theft, or disruption of service. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict network access to the affected endpoints and consider disabling or limiting the use of the vulnerable APIs if possible. Monitor vendor communications for updates on remediation.