CVE-2026-9202 is a critical vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.10.0) where missing authentication controls allow unauthenticated attackers to create unlimited user accounts. When the documented deployment option NEW_USER_IS_ACTIVE=true is enabled, newly created accounts are active immediately and can authenticate to access RCE endpoints, bypassing the AUTO_LOGIN mechanism. This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score of 9.8, indicating critical severity. No official patch or remediation guidance has been published by IBM as of the data provided.

An attacker can create unlimited active user accounts without authentication, enabling them to authenticate and potentially execute remote code on the affected Langflow OSS instance. This compromises confidentiality, integrity, and availability of the system, representing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or avoid setting NEW_USER_IS_ACTIVE=true to prevent automatic activation of newly created accounts. Additionally, restrict access to the Langflow OSS instance to trusted networks and monitor for unauthorized account creation.