Langflow RCE: 34 minutes to server compromise
We analyzed how a popular AI infrastructure platform is being exploited in the wild.
CVE-2026-9198 allows an unauthenticated attacker to execute code on default-configured Langflow hosts. After CISA confirmed active exploitation, we exposed vulnerable Langflow instances for 542.4 host-hours to study it. This article documents how attackers exploited the flaw, which credentials they accessed, which payloads they deployed and how defenders can identify affected systems.
What we found
- 67% of completed exposure windows received attacker code execution.
- 19% of attacker IPs left a miner or remote-control implant running.
- 31% of attacker IPs exfiltrated a planted OpenAI credential.
- Detection signal
- A request to /api/v1/auto_login followed by an authenticated request to /api/v1/validate/code containing Python that executes through a decorator, default argument or annotation.
- Affected
- Langflow OSS 1.0.0 through 1.10.0
- Default-configured deployments with auto-login enabled and the code-validation endpoint exposed
By the numbers
- Exposure windows
- 18
- Windows with code execution
- 12
- Executed exploit requests
- 320
- Actor sources that executed
- 31
- Time to first execution
- 34m min 15h median 38h max
542.4 host-hours across 18 completed exposure windows.
Unique source addresses counted over the completed exposure windows.
Fourteen sources issued 66 credential-search commands.
Six additional API-only sources received it without code execution.
Four source addresses belonged to two XMRig operations.
One AdaptixC2 agent and one Mirai-like bot.
The command trace does not distinguish a person from an agent.
The observed behavior post-infiltration.
Measured against a popular alternative
| Measure | Bitbison | Alternative |
|---|---|---|
| Dropped malware detected | 100% | 0% |
| Alerts raised | 20 | 1 |
| False positives | 0 | 0* |
* The alternative's zero came from a single credential-search alert. It missed all of the dropped malware.
Both systems ran over the same 521.2 host-hours on the same instances. The alternative used its vendor's stock ruleset; neither system was tuned for Langflow. Bitbison detected malware at all six drop locations with 20 alerts.
Campaigns
AdaptixC2 Gopher implant
An attacker evaluated three hosts over 37 minutes and deployed a custom AdaptixC2 Gopher implant to one. The implant supported remote commands, file operations, process inspection and screenshot capture. We decrypted two captures of its command-and-control traffic but observed no commands from the server.
Details1 sample
Identified malware
| Sample | What it is |
|---|---|
| 1835f74486 | Custom development build of the AdaptixC2 gopher agent |
XMRig 6.22.2 with a restart supervisor
An attacker deployed XMRig 6.22.2 with a Python supervisor that restarted the miner every ten seconds. Its rig name combined `lf9` with the victim's address, linking the deployment to Langflow exploitation. The same wallet had received more than 657,000 accepted shares and included two rigs labelled for a different exploit.
Details2 samples
Identified malware
| Sample | What it is |
|---|---|
| b0e1ae6d73 | Stock upstream XMRig 6.22.2 binary |
| f11076cfdf | Victim-specific Python supervisor that restarts the miner |
Multi-platform XMRig 6.26.0 loader
An attacker used a POSIX shell stager to deploy XMRig 6.26.0 builds for Linux x86-64, Linux ARM64 and FreeBSD amd64. The x86 payload deleted itself after launch and returned under randomized names after hosts were rebuilt; we recovered it from `/proc`. The miner used TLS and did not contain its pool or wallet configuration, which prevented wallet attribution.
Details4 samples
Identified malware
| Sample | What it is |
|---|---|
| c61cd83b6f | Architecture-dispatching POSIX shell stager |
| 0b8e037d16 | UPX-packed x86-64 XMRig 6.26.0 payload |
| 6a1f70ef89 | Stock ARM64 XMRig build served by the same stager |
| ed23db197d | Stock FreeBSD amd64 XMRig build served by the same stager |
Multi-architecture Mirai-like bot
An attacker attempted x86, ARMv7 and MIPS payloads before successfully installing an i386 bot as `/tmp/klogd`. The binary registered over HTTP and supported remote commands through a custom protocol. MalwareBazaar identifies it as Mirai. It was not a miner.
Details1 sample
Identified malware
| Sample | What it is |
|---|---|
| 3a56f24ab2 | Stripped static i386 Mirai-like bot recovered as /tmp/klogd |
Exploit payloads observed in the wild
The table below summarizes the 328 exploit attempts observed in the wild against our Langflow fleet.
| Where the attacker put the payload | Attempts | Share |
|---|---|---|
Default argument, def f(x=exec(...)) | 234 | 71.3% |
Decorator, @exec(...) | 73 | 22.3% |
| Top-level code, malformed input or validation probes | 17 | 5.2% |
| Component payload exposing environment variables | 4 | 1.2% |
Because Langflow returned command output in validation responses, 29% of attacker IPs that achieved code execution received every planted environment secret. 6 of the 15 sources that exfiltrated the planted OpenAI key retrieved it from saved flow data with a token from /api/v1/auto_login; none called /api/v1/validate/code. A successful full-data GET /api/v1/flows after /api/v1/auto_login from an untrusted source means credentials stored in the returned flow definitions were exposed and must be rotated.
Scan volume did not predict Langflow exploitation
| Window | External requests/hour | Exploit attempts |
|---|---|---|
| Busiest window in the study | 192.2 | 0 |
| Second busiest | 149.5 | 0 |
| Quietest window in the initial round | 24.9 | 36 |
| Quietest window that was exploited | 8.5 | 3 |
Ten attacker IPs showed response-aware or interactive behavior
| Observed behavior | Attacker IPs | Share |
|---|---|---|
| Likely automation | 15 | 48% |
| Response-aware, person or agent | 9 | 29% |
| Interactive operation | 1 | 3% |
| Insufficient activity to classify | 6 | 19% |
Likely automated sources repeated fixed commands without reacting to the response. One miner submitted the same invalid Python eight times despite receiving the same error. The Mirai-like campaign sent its first x86 attempt to three hosts within 81 milliseconds, then continued downloading payloads after the first attempt had already succeeded.
Response-aware sources used information returned by the hosts. In one operation, an IP ran su - with a planted password and an account name that had only been returned to a different IP 13 minutes earlier. The four IPs therefore shared reconnaissance results.
The AdaptixC2 source behaved interactively. It tested execution with 1+1, selected one of three hosts, inspected /tmp and checked permissions between failed launch attempts. These actions show active control of the session, but the command trace alone cannot determine whether that control came from a person or an agent.
What defenders should do
- Upgrade Langflow to 1.10.1 or later. IBM lists no workaround for affected versions.
- Treat an internet-exposed deployment running 1.0.0 through 1.10.0 with auto-login enabled as potentially compromised.
- Search proxy and application logs for
/api/v1/auto_loginfollowed by/api/v1/validate/codeor a successful full-dataGET /api/v1/flowsfrom an untrusted source. - Rotate credentials stored in returned flow definitions and every credential available to the Langflow service environment. Validation responses may have returned those values directly to the attacker.
- Investigate deleted but running executables through process or kernel telemetry. Two payloads removed their filesystem paths after launch, and one was recoverable only through
/proc. - Rebuild after containment. Rebuilding without upgrading or removing the vulnerable service restores the same exposure.
Want more? Security researchers can contact us at team@. We are happy to share additional data.
Indicators
- hashes
1835f744861e9aa6bf965ed9f21cc0109b3d01888d5b8f8c304c5cc297a9d9bdb0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848df11076cfdf1e60ff7e117c879504f9be20432b0aadf9b8f8a37e3d4bbb22e92fc61cd83b6f8f0bcf08ed475b4001a1a44ff262dd1649c5ba03b06d542948024b0b8e037d160bdb0b621c975c424f680b814bc438fd492ae376ff3140e209e4806a1f70ef89684037bb3d0536657f00a92fbbcdb9067195b060128a221df79df5ed23db197d907bdb6873c02b7222110321b0f859e329c420a6d0d6e50220308f3a56f24ab23598a62933859f8839bf74796547c29d5e78727e56fbc497327330
Sources
- IBM — Unauthenticated remote code execution via auto-login and code validation
- NVD — CVE-2026-9198
- CISA — Known Exploited Vulnerabilities entry for CVE-2026-9198
- Langflow — Release 1.10.1
- Langflow — Release 1.11.3
- PyPI — Current Langflow release
- MalwareBazaar — AdaptixC2 gopher sample
- MalwareBazaar — Mirai-like klogd sample