Langflow RCE exploited in the wild; LangGraph, CrewAI share the bug
CISA set an Aug 7 patch deadline as PoCs circulate; Check Point's Black Hat talk shows the same checkpointer flaw runs through LangChain and AutoGen too.
Copy markdown
Unauthenticated RCE, and CISA says it's live
CVE-2026-9198 (CVSS 9.8) chains two Langflow API endpoints to bypass login and run code on default deployments. CISA added it to its actively-exploited catalog on Aug 5 with an Aug 7 federal patch deadline; the fix is Langflow 1.10.1.
Black Hat: the framework is the bug, not the prompt
Check Point told Black Hat on Aug 5 that the orchestration layer — not prompt injection — is the real hole, demoing a SQLi-to-RCE chain through LangGraph's checkpointer, the store that holds an agent's memory. LangChain, CrewAI, and AutoGen carry the same class of flaw.
Why an orchestration RCE is the whole game
These frameworks run with your API keys, database creds, and tool access, so code execution in the checkpointer isn't a jailbroken reply — it's control of the agent host. That is a far bigger blast radius than any prompt-injection demo.
Your patch list for tonight
If you self-host: Langflow to 1.10.1, langchain-core to 1.2.22 (or 0.3.81), and langgraph-checkpoint-sqlite to 3.0.1. Managed services like LangSmith are not affected — this hits the code you run yourself.
PoCs are public — and it's the second one
Working exploits for CVE-2026-9198 surfaced in late July, and it is Langflow's second critical unauthenticated RCE in weeks (after CVE-2026-0770). Thousands of internet-exposed instances are already being probed.