The tooling teams use to build AI applications is now a target in its own right, and Langflow is the current demonstration.

CVE-2026-9198 is a code injection flaw carrying a CVSS of 9.8. It allows an unauthenticated attacker to achieve full remote code execution against a default Langflow deployment. No credentials, no misconfiguration required — the out-of-the-box install is the vulnerable one.

CISA added it to the Known Exploited Vulnerabilities catalog on 5 August 2026, giving federal agencies until 7 August to remediate.

This was not a quiet bug

The exploitation volume is the part worth sitting with. KEVIntel telemetry recorded 650 exploitation attempts beginning 6 July 2026, from 244 unique attacker IP addresses across 41 countries.

That is not targeted intrusion. That is internet-wide scanning against a known-good payload, and the shape of it — many sources, one bug, immediate volume — says the exploit was commodity within days.

A patch existed. Langflow fixed this in version 1.10.1, released in July 2026. The month between the patch and the KEV listing is the window in which unpatched deployments were being found by people running the scan.

Why AI tooling keeps ending up here

Langflow is an open-source platform for building AI applications visually. Its purpose is to execute user-defined logic — that is the product, not a side effect. Platforms whose core function is running code someone supplied have a narrower margin between a feature and a vulnerability than most software.

Two things make these deployments unusually attractive:

  • They hold credentials. An AI app builder is wired into model API keys, vector stores, databases and internal services. RCE on the builder is access to everything it was configured to reach.
  • They get stood up outside change control. These tools frequently arrive as an experiment on someone's cloud account and become load-bearing without ever entering an asset inventory. Nobody patches what nobody has written down.

The other one in the same advisory

The same CISA update flagged CVE-2026-34486 in Apache Tomcat — CVSS 7.5, a missing-encryption flaw allowing a bypass of EncryptInterceptor.

Its history is the uncomfortable part. Tomcat fixed it in April 2026 (versions 11.0.21, 10.1.54 and 9.0.117). Between late April and early June, China-nexus actors weaponised it against government and commercial infrastructure in more than 100 countries to deliver malware tracked as SNOWLIGHT — months of operational use before it reached the KEV catalog.

What to check

  • Langflow: upgrade to 1.10.1 or later, and treat any internet-exposed instance running an older build as compromised rather than merely vulnerable, given the scanning volume since July.
  • Rotate what the deployment could reach. Model API keys, database credentials, service tokens. RCE means those were readable.
  • Take the exposure off the internet. There is rarely a reason for an internal AI-building tool to accept unauthenticated connections from anywhere.
  • Tomcat: confirm you are on 11.0.21 / 10.1.54 / 9.0.117 or later. An April patch is old enough that "we'll get to it" has already been tested.

Neither of these is an AI safety story in the sense the term usually carries. It is more ordinary and more immediate: the infrastructure being assembled to run AI is software, it ships with the same classes of flaw as everything else, and it is being scanned for right now.