Talk to a security expertFree technical auditFree audit

Case study

An independent reconstruction of the unauthenticated Langflow RCE, with a lab differential between 1.10.0 and the 1.10.1 fix.

By Riftweld Labs

Case studies1 min read

CVE-2026-9198 is a CVSS 9.8 unauthenticated remote code execution in Langflow 1.0.0 through 1.10.0, fixed in 1.10.1 and added to CISA's Known Exploited Vulnerabilities catalogue on 4 August 2026.

This is an independent reconstruction of the published vulnerability, not the original discovery.

What we did

  • Rebuilt the code-injection path on Langflow 1.10.0.
  • Ran the same steps against the patched 1.10.1 release to capture the differential.
  • Wrote an end-to-end lab PoC and kept the transcript.
  • Sent coordinated notices to eight hosting providers whose infrastructure carried exposed instances. Per-instance data was withheld from every public copy.

Evidence

What it does not prove

The work covers the versions and configuration tested in our lab. It does not establish the state of any third-party deployment, and it makes no claim about systems we did not test.

Keep reading.

Everything from Labs

Adversary simulation

Prove the route before someone else does.

We reproduce the path an attacker would take, show the impact with evidence, then retest after the fix.

Scope an engagementStart with a free audit