Langflow RCE Vulnerability Added to CISA KEV Amid Active Attacks

What happened

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Langflow vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The move means the flaw is no longer a theoretical risk. Attackers are already using it.

On August 5, 2026, CISA added three vulnerabilities to the KEV list and cited evidence of exploitation in the wild 1. The most severe is CVE-2026-9198, a code injection bug in Langflow with a CVSS score of 9.8 1. It lets an unauthenticated attacker achieve full remote code execution on a default Langflow deployment 1. The same round of additions reportedly covers flaws in Apache Tomcat and N-central 1.

Other coverage gives a somewhat different list. It pairs the Langflow bug with a critical vulnerability in Trivy, the widely used open-source security scanner, and frames both as risks tied to AI frameworks and security tooling 2. That account also stresses the main consequence of a KEV listing: federal agencies must patch by mandated deadlines 2.

Where the accounts differ

Both reports agree on the central fact: Langflow is on the KEV list and is being exploited 12. They differ on what else was added. One names Tomcat and N-central as the companion entries 1. The other names Trivy 2.

The available reporting doesn't explain the gap. The flaws may have been added in separate batches, or one outlet may have chosen to highlight different entries. Defenders should not rely on secondhand summaries here. They should check the KEV catalog itself for the full list and for the remediation dates attached to each entry.

Why the Langflow flaw matters most

Langflow is a framework for building applications and workflows on top of large language models. Three traits of CVE-2026-9198 make it especially dangerous [1]:

• No login required. The attacker doesn't need credentials.
• Default setups are exposed. No unusual configuration is needed to be vulnerable.
• The payoff is full code execution. An attacker gains complete control of the system.

Taken together, this describes a bug that can be exploited at scale with little effort. Any internet-facing Langflow instance should be treated as a likely target.

The bigger issue may be what Langflow typically has access to. Tools in this category usually hold API keys for model providers, database credentials, and connections to internal data sources, because that access is what makes them useful. Compromising such a server could open a path to far more sensitive systems. This is analysis rather than a reported incident, but it explains why an RCE in an AI orchestration tool deserves the same urgency as one in a traditional web server.

The broader pattern: AI tooling and security tools as targets

One outlet explicitly links this KEV update to growing AI risk 2. The framing is reasonable. AI development tools were often adopted quickly by teams experimenting outside normal IT governance. Many instances were spun up for prototyping, exposed to the internet for convenience, and never hardened. A flaw that works against default deployments is a near-perfect fit for that environment.

The Trivy entry, if it holds up, makes a related point 2. Security scanners usually run with broad access inside build pipelines and container environments. That privileged position makes them valuable to attackers. A tool meant to find weaknesses can become one if it isn't kept up to date.

The other named entries are a reminder that older software remains a target too:

• Tomcat is foundational Java web infrastructure 1.
• N-central is a remote monitoring and management platform used by IT service providers 1.

Remote management tools are attractive because a single compromise can spread to many downstream customers.

What organizations should do

KEV deadlines legally bind only federal civilian agencies 2. Even so, many private-sector security teams use the catalog as a prioritization list, and they should here. Recommended steps:

• Find every Langflow instance, including forgotten test and prototype deployments.
• Patch or isolate any that are exposed. Assume internet-facing default installs may already be compromised.
• Rotate credentials stored in or reachable from those systems.
• Review Tomcat, N-central, and Trivy deployments against the official KEV entries, given the uncertainty over exactly which flaws were included.

The takeaway

The Langflow listing is the clearest signal in this update. AI orchestration frameworks have crossed from "emerging risk" to "actively exploited infrastructure." Organizations that still treat these tools as experimental side projects are running production-grade exposure without production-grade defenses. This KEV entry is a strong reason to close that gap now.