650 exploitation attempts from 41 countries: CISA adds the Langflow flaw to its catalog

A design flaw in the Langflow agent platform allows for remote code execution without authentication. CISA has added it to its list of actively exploited flaws.

The flaw referenced CVE-2026-9198 affects Langflow, the open source platform used to visually assemble chains of agents and model calls. Rated 9.8 on the CVSS scale, it lets an unauthenticated attacker execute arbitrary code on an installation left in its default configuration. The patch has been available since July 2026 in version 1.10.1.

CISA added the flaw to its catalog of actively exploited vulnerabilities on August 5, 2026, with U.S. federal agencies required to apply the patch as of August 7. KEVIntel's telemetry records show 650 exploitation attempts since July 6, 2026, from 244 distinct IP addresses in 41 countries.

This is not the first episode of its kind for this tool: its security flaws have already been used in recent months to deposit cryptocurrency miners and ransomware. The orchestration layer, which by construction concentrates the API keys of model providers and access to connected databases, becomes a prime target regardless of the robustness of the models themselves.