KDCube
← AI Industry News

Agent Frameworks' Security Bill Comes Due: Langflow RCE Hits CISA's KEV

An unauthenticated Langflow RCE (CVE-2026-9198, CVSS 9.8) landed in CISA's Known Exploited Vulnerabilities catalog with a federal Aug 7 deadline, and researchers count roughly 7,000 exposed servers under active attack. Check Point's SQLi-to-RCE chain in LangGraph's checkpointer reframes agent security around framework middleware — not ...

Highlights

  • CISA added the unauthenticated Langflow RCE CVE-2026-9198 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog on Aug 4, with a federal remediation deadline of Aug 7 (The Hacker News). Researchers report roughly 7,000 internet-exposed Langflow servers under active exploitation (VentureBeat).
  • Check Point Research detailed a SQL-injection-to-RCE chain in LangGraph's checkpointer, part of a broader batch of framework-layer flaws spanning LangChain, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK (Check Point Research).
  • The takeaway from both: prompt injection is the delivery mechanism, not the bug — the real holes are 20-year-old classes (insecure deserialization, SSRF, path traversal) sitting in agent middleware that now touches inboxes, databases, and state (Pravda EN).
  • Meanwhile Google shipped platform, not patches: agent and model evaluations plus Memory Bank profiles reached GA in the Gemini Enterprise Agent Platform this week (Google Developers Blog).

Key Signals

  1. Langflow RCE goes from disclosure to active exploitation to a federal deadline - CISA KEV, Aug 4; deadline Aug 7

    CVE-2026-9198 lets an unauthenticated caller chain two endpoints — /api/v1/auto_login, which mints SUPERUSER tokens, and /api/v1/validate/code, which runs attacker-supplied Python via exec() — for full RCE on default deployments of IBM's Langflow OSS 1.0.0–1.10.0 (The Hacker News). A fix shipped in July, but ~7,000 exposed instances are still being hit, so any team running a public Langflow builder should treat this as an emergency patch-or-disconnect (VentureBeat).

  2. Check Point reframes agent security around the framework, not the prompt - Check Point Research / Pravda EN, Aug 5–6

    Check Point's "From SQLi to RCE" write-up shows LangGraph's SQLite/Redis checkpointer executing injection via a user-controlled get_state_history() filter (tracked as CVE-2026-27022), and its wider disclosure flags an RCE path via untrusted checkpoint loading in Microsoft Agent Framework and a file-writing ADK assistant reachable over HTTP by default (Check Point Research, Pravda EN). The lesson for builders: attacker-controlled content crossing from the data plane into trusted routing, memory, and state is where agentic apps actually break.

  3. Google keeps building the governed-runtime story - Google Developers Blog, ~Aug 5–6

    Agent and model evaluations and structured Memory Bank profiles both hit GA in the Gemini Enterprise Agent Platform, giving operators native eval harnesses and low-latency memory without bespoke search — a direct counterweight to the "unwatched agents" theme this channel has tracked all week (Google Developers Blog).

Why It Matters / What To Watch

  1. Your agent stack's supply chain is now an attack surface with a deadline.
    • Inventory every Langflow, LangGraph, and CrewAI deployment; confirm you are past the patched Langflow release and that no builder UI is internet-exposed (The Hacker News).
    • If you self-host LangGraph with a SQLite or Redis checkpointer, audit any code path exposing get_state_history() with user-controlled filters before trusting persisted state (Check Point Research).
  2. Boundary discipline beats prompt-filtering.
    • Treat memory, checkpoints, and tool routing as untrusted-input sinks — deserialization and SSRF, not clever jailbreaks, are the exploited classes (Pravda EN).
    • Watch whether framework maintainers ship secure-by-default checkpointers and disable dev endpoints in production images; pair that hardening with the eval/observability surfaces now going GA on managed platforms (Google Developers Blog).

Quick Links