CVE-2026-9202

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: 0.29%; 22th pct
KEV: No
Class: other; CWE-306

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

References

https://www.ibm.com/support/pages/node/7278929

Status: profiled · ingested 2026-07-24T18:00:18.000Z