CVE-2026-9198Discovered Published
IBM Langflow OSS: auto-login and code-validation chain (CVE-2026-9198)
Advisory record · Vendor advisory
Status. Two-tier request-filter comparison against Eden 1.103.0 using a synthetic HTTP fixture.
The vulnerability
The advisory describes chaining unauthenticated auto-login with code validation in IBM Langflow OSS 1.0.0 through 1.10.0. Version 1.10.1 contains the fix.
The Eden patch
Tier 1 — declarative policy. Deny all requests under the fixture prefix /api/v1/validate, including benign requests.
Tier 2 — native Rust module. Match /api/v1/validate/code and refuse requests containing a configured marker in the body.
Measured comparison (2026-11-12 UTC)
| Configuration | Benign request | Attack fixture |
|---|---|---|
| Baseline | HTTP 200 | HTTP 200, backend marker recorded |
| Tier 1 route deny | HTTP 403 | HTTP 403 |
| Tier 2 native module | HTTP 200 | HTTP 403, backend marker absent |
Signed module authority
The module was imported for explicit activation. All expected shards acknowledged activation. Reader inspection, a tampered statement and an invalid signature were rejected. After revocation the same request received HTTP 503. Re-approval and reactivation restored HTTP 403.
Test scope
The fixture matches body markers on the code-validation route. Token issuance at auto-login and the full two-request chain remain unverified.
The measurements cover the supplied fixture probes. Alternate routes, encodings, and other bypasses remain untested.