The Flaw CISA Just Flagged
CVE-2026-9198 is a code injection vulnerability in Langflow that enables unauthenticated remote code execution on default deployments, carrying a CVSS score of 9.8, effectively the maximum severity rating available. Langflow's maintainers fixed it in version 1.10.1, released in July, but CISA's August 5 update to its Known Exploited Vulnerabilities catalog confirmed the flaw was already being exploited before most organizations had a chance to patch. Telemetry cited by The Hacker News shows 650 exploitation attempts originating from 244 unique attacker IP addresses spread across 41 countries, starting July 6.
CISA's addition came bundled with two other actively exploited flaws, in Apache Tomcat and N-able's N-central platform, and set a federal patch deadline of August 7, just two days out. That compressed timeline is CISA's clearest signal that exploitation was not theoretical. For a tool that sits at the center of how many teams now build and deploy AI agents, an unauthenticated RCE on default configuration is close to a worst-case scenario.
This Isn't Langflow's First Critical Flaw This Year
Roll the clock back to July 1, and Orca Security disclosed CVE-2026-33017, another CVSS 9.8 flaw, this time in Langflow's public flow-building API endpoint, where insufficient input validation let attackers execute arbitrary Python code without authentication. Orca observed attackers weaponizing the flaw within 20 hours of the security advisory, before any public proof-of-concept existed, and used it to deploy a Go-based binary called lambsys that kills competing cryptominers, disables AppArmor, SELinux, UFW, and iptables, wipes logs, and installs a customized XMRig Monero miner.
Go back further, to a flaw in versions before 1.3.0, and a separate unauthenticated RCE in an API endpoint used for code validation became the entry point for something considerably more damaging than a coin miner. Three critical, unauthenticated remote code execution bugs in the same open-source project inside a few months is not bad luck. It is a pattern that says Langflow's attack surface, and by extension every AI orchestration tool built on a similar model, warrants far more scrutiny than most security teams have been giving it.
When Ransomware Learned to Target Model Weights
The most consequential of the three campaigns is ENCFORGE, a compiled Go ransomware strain that Sysdig researchers linked to a threat actor tracked as JADEPUFFER. Rather than encrypting generic office files, ENCFORGE goes after roughly 180 file extensions specific to AI and machine learning workloads: PyTorch checkpoints, TensorFlow files, Hugging Face SafeTensors, ONNX format weights, GGUF and GGML model files, FAISS vector indexes, and Parquet and Arrow datasets used for training. It reached victims by exploiting the same unauthenticated Langflow RCE pattern, this time in the code-validation endpoint.
Sysdig's researchers estimate that rebuilding a single encrypted production model can cost between 75,000 and 500,000 dollars in cloud GPU compute and engineering time, a figure that reframes what a ransomware payment demand is actually competing against. The ransom contact address matched prior JADEPUFFER campaigns, suggesting a repeat operator rather than an opportunistic copycat. For any organization running production AI infrastructure, this is the clearest evidence yet that model weights and vector stores are now a named target category, not incidental collateral damage in a broader encryption sweep.
Why AI Tools Keep Getting Popped Like This
Langflow's appeal is also its exposure problem. It is designed to let teams stand up AI agents and workflows quickly, often through a visual interface backed by API endpoints that accept and execute code by design, since that is the point of a flow-building tool. That same design choice, code execution as a core feature rather than an edge case, is exactly what makes each new RCE so severe and so fast to weaponize once attackers understand the pattern.
Tools adopted during a pilot or proof-of-concept phase frequently end up exposed to the internet with default configurations, because the point of a pilot is speed, not hardened deployment. Three critical flaws in one popular AI framework within a few months suggests this is not a one-off maintainer oversight. It is a structural risk in how quickly AI tooling gets shipped and deployed relative to how carefully it gets secured.
The Governance Gap in Most AI Pilots
Most enterprise AI governance conversations today focus on model outputs: hallucination, bias, data leakage through prompts. Far fewer focus on the infrastructure those models actually run on, and whether the orchestration layer sitting in front of them has been through the same vulnerability management process as a production database. Langflow's 2026 track record argues that the infrastructure question deserves equal billing, because an unauthenticated RCE bypasses every output-level control an organization has built.
If your organization has deployed Langflow, or any comparable open-source AI agent-building tool, the immediate task is confirming version 1.10.1 or later is running everywhere it exists, including instances that started as a two-week pilot and quietly became load-bearing. Shadow AI infrastructure is a real and growing risk category, and it is where exactly this kind of flaw tends to sit longest, unpatched and unmonitored, sometimes for months after the team that built it has moved on to other priorities. A recurring audit of every AI tool with a public endpoint should be a standing item on your security calendar, not a one-time response to this specific advisory.
What We'd Tell a CTO Monday Morning
Inventory every Langflow instance in your environment, including ones your data science or platform engineering teams may have spun up outside the standard software catalog, and confirm each is on 1.10.1 or newer today. Check for indicators tied to the lambsys cryptominer and the ENCFORGE ransom contact address if you have any exposure to earlier versions, and treat any hit as an active incident requiring immediate isolation rather than a routine cleanup task.
Then widen the lens beyond this single product. Ask which other AI orchestration and agent-building tools in your stack accept and execute code by design, and whether those tools sit behind the same authentication and network segmentation controls you would require for a production database. If the answer is no, that gap is now demonstrably exploitable within hours of public disclosure, and closing it belongs on this week's list, not next quarter's roadmap, given what ENCFORGE just proved is possible against unprotected AI infrastructure.
