Langflow Has an RCE on CISA's Exploit List; LangGraph Has a CVE Chain — Patch Your Agent Infrastructure

TL;DR: Langflow's unauthenticated RCE (CVE-2026-9198, CVSS 9.8) is actively exploited and CISA-listed; a LangGraph CVE chain lets crafted input reach your LLM API keys. Both have been patched — but the attacks are ongoing.

These CVEs were patched in early August; if your agent infrastructure runs either framework and hasn't been updated, it is being attacked right now.

Langflow (CVE-2026-9198): The /api/v1/auto_login endpoint mints SUPERUSER tokens for any network caller without requiring authentication. Chained with /api/v1/validate/code, which runs user-supplied code via Python's exec(), the result is unauthenticated full RCE on default deployments. IBM patched it July 17; CISA added it to the Known Exploited Vulnerabilities catalog August 4. KEVIntel recorded 650 exploitation attempts from 244 unique IPs starting July 6 — eleven days before the patch existed. Fix: upgrade to Langflow ≥1.10.1.

LangGraph (three linked CVEs): Check Point Research found SQLite injection (CVE-2025-67644), msgpack deserialization RCE (CVE-2026-28277), and Redis injection (CVE-2026-27022) in LangGraph's checkpointer backends, reachable when an app exposes get_state_history() with a user-controlled filter. A compromised server exposes LLM API keys, customer data, and internal network access. The same research logged 11 CVEs across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK; the pattern is decade-old injection classes (deserialization, path traversal, SSRF) sitting beneath agentic logic.

Why it matters: The attack surface is not prompt injection — your API keys live in the agent's process environment, and a vulnerable framework endpoint takes them without touching the model. Check for Langflow especially: it's common as a no-config flow builder in agent prototypes that graduate to production without a security review.

Sources: Hacker News: CISA flags Langflow RCE · The Register: AI agent framework flaws · KEVIntel: CVE-2026-9198 telemetry