IBM Langflow Auto-Login Bypass Probes (CVE-2026-9198) for 2026-10-21
Oct 21, 2026
Exploitation
Last Updated: 00:00 UTC
CVE-2026-9198 is an authentication bypass in IBM Langflow: the /api/v1/auto_login endpoint issues a session without credentials, giving access to flows that can execute arbitrary Python. These IPs requested that endpoint on our reverse proxy.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| United States | 2 | 40.0% |
| Japan | 1 | 20.0% |
| The Netherlands | 1 | 20.0% |
| Belgium | 1 | 20.0% |
IP Address : ASN : City/Provider
-
136.66.105.27 : AS396982 Google LLC : The Dalles
-
34.146.232.153 : AS396982 Google LLC : Tokyo
-
34.63.76.199 : AS396982 Google LLC : Council Bluffs
-
35.204.233.96 : AS396982 Google LLC : Groningen
-
35.240.61.234 : AS396982 Google LLC : Brussels