CISA Warns of Exploited Langflow, N-central, and Tomcat Vulnerabilities
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-9198 in IBM Langflow OSS (CVSS 9.8), CVE-2026-18556 in N-able N-central (CVSS 7.4), and CVE-2026-34486 in Apache Tomcat (CVSS 7.5) The Langflow OSS flaw allows unauthenticated remote code execution by chaining an auto-login endpoint that issues superuser tokens with a code validation endpoint that executes arbitrary Python code The N-able N-central authentication bypass was exploite
Analysis
TL;DR
- CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-9198 in IBM Langflow OSS (CVSS 9.8), CVE-2026-18556 in N-able N-central (CVSS 7.4), and CVE-2026-34486 in Apache Tomcat (CVSS 7.5)
- The Langflow OSS flaw allows unauthenticated remote code execution by chaining an auto-login endpoint that issues superuser tokens with a code validation endpoint that executes arbitrary Python code
- The N-able N-central authentication bypass was exploited as a zero-day, and its initial patch was itself bypassed, requiring a follow-up hotfix tracked as CVE-2026-18577
- The Apache Tomcat EncryptInterceptor bypass was introduced by a one-line code change in an April patch that flipped the encryption layer from fail-closed to fail-open, enabling unauthenticated RCE on cluster members
- CISA mandated patching by August 7 under BOD 26-04, while threat actors including Chinese-linked groups have been actively exploiting the Tomcat flaw using AI-enabled autonomous hacking campaigns and the Snowlight malware family
Why It Matters
This alert highlights the accelerating pace at which critical vulnerabilities in widely deployed open-source and enterprise infrastructure are being weaponized, with proof-of-concept code appearing within days and nation-state actors incorporating AI tools into autonomous exploitation campaigns. For AI practitioners and security teams, the Langflow OSS vulnerability is particularly salient given the framework's growing adoption for building LLM-powered applications, while the Tomcat flaw underscores how even minor patching mistakes can introduce catastrophic fail-open conditions in production clusters.
Technical Details
- CVE-2026-9198 (IBM Langflow OSS, CVSS 9.8): Two chained flaws—an unauthenticated auto-login endpoint issues superuser bearer tokens to any network caller, and a code validation endpoint executes arbitrary Python code. Attackers obtain a superuser token via the auto-login endpoint, then submit malicious Python code through the validation endpoint, achieving unauthenticated RCE. Patched in Langflow OSS version 1.10.1 on July 17; all default deployments are affected. PoC code published approximately one week after disclosure.
- CVE-2026-18556 (N-able N-central, CVSS 7.4): Authentication bypass allowing threat actors to gain administrative access to the remote monitoring and management (RMM) platform and connect to managed systems. Exploited as a zero-day. The initial fix was incomplete and bypassed by attackers, prompting a hotfix tracked as CVE-2026-18577. Both CVEs are now in CISA's KEV catalog.
- CVE-2026-34486 (Apache Tomcat, CVSS 7.5): EncryptInterceptor bypass affecting cluster communications. The vulnerability was introduced in March when a one-line code change in the patch for CVE-2026-29146 (a padding oracle flaw) converted the encryption layer from fail-closed to fail-open. On failed decryption, attacker-controlled code is forwarded unmodified up the interceptor chain to the deserialization layer, enabling unauthenticated RCE on every cluster member. Patched in April; exploited by Chinese threat actors using Snowlight malware and AI-enabled autonomous hacking tools.
Industry Insight
- The Langflow OSS vulnerability serves as a stark reminder that AI development frameworks, while accelerating application delivery, often ship with default configurations that expose high-privilege endpoints to unauthenticated access—organizations deploying Langflow must immediately verify their version and restrict network exposure until patched.
- The N-able N-central incident demonstrates the dangerous pattern of incomplete patches being rapidly bypassed in the wild; vendors should adopt bug-bounty-style internal red-teaming before releasing security fixes, and enterprises should treat initial patches with skepticism until independent verification confirms the bypass is closed.
- The Apache Tomcat flaw, exploited by state-sponsored actors using AI-augmented campaigns, signals a new escalation in automated vulnerability exploitation where threat actors leverage AI to discover, chain, and deploy exploits at scale—security operations should prioritize automated monitoring for exploitation indicators and enforce strict cluster segmentation to limit blast radius.
Disclaimer: The above content is generated by AI and is for reference only.