🚨 CRITICAL - Unauthenticated account creation bypass in IBM Langflow OSS (CVE-2026-9202) IBM Langflow OSS contains a flaw in its user registration/account provisioning logic that allows unauthenticated attackers to create unlimited user accounts on a target Langflow instance. The root cause is improper authentication and access control on the account creation workflow, enabling a registration bypass. An attacker exploits this remotely over the network with no privileges by hitting the exposed signup/user-creation endpoints; if NEW_USER_IS_ACTIVE=true, the new accounts are immediately active and can authenticate without relying on AUTO_LOGIN. Impact is severe: attackers can gain authenticated access and pivot to Langflow’s RCE-capable endpoints, resulting in full remote code execution and potential takeover of the host and data. 👉 Affected: IBM Langflow OSS 1.0.0–1.10.0 | Upgrade to 1.10.1 or later (or disable NEW_USER_IS_ACTIVE and restrict registration until patched)
Post summary
IBM Langflow OSS is vulnerable to an unauthenticated account creation bypass (CVE-2026-9202) that can lead to remote code execution; affected versions 1.0.0–1.10.0 are mitigated by upgrading to 1.10.1 or disabling auto‑activation.
