CVE-2026-9202

CriticalCVSS 9.8

Published: 17/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

22th percentile - higher than 22% of all known CVEs

Summary

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to create unlimited user accounts. When NEW_USER_IS_ACTIVE=true is set, new accounts are immediately active and can access RCE endpoints.

Risk Assessment

Risk of unauthorized access to RCE endpoints, potentially leading to full compromise of the Langflow instance and data breach.

Recommendation

Disable the NEW_USER_IS_ACTIVE=true option. Enforce authentication for all API endpoints. Consider upgrading to a newer version.

Original NVD description (English source)

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.