CVE-2026-9202 — Unauthenticated User Registration Could Lead to Remote Code Execution

CVE-2026-9202

Unauthenticated User Registration Could Lead to Remote Code Execution PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate to reach RCE endpoints, bypassing the need for AUTO_LOGIN.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.0

CWE

CWE-306

References

https://www.ibm.com/support/pages/node/7278929

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.