Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-9198.
Unlock with Pro - from £29/user/moDetect IBM Langflow Code Injection Exploitation (CVE-2026-9198) in Google Chronicle
Detects exploitation attempts against IBM Langflow instances vulnerable to CVE-2026-9198, a code injection vulnerability (CWE-94) that allows unauthenticated or authenticated attackers to execute arbitrary code via crafted requests to Langflow's component/flow execution API. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on anomalous process execution spawned by the Langflow application, suspicious payloads to Langflow API endpoints, and post-exploitation indicators such as reverse shells, credential harvesting, or outbound C2 connections originating from Langflow hosts.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
YARA-L Detection Query
rule langflow_code_injection_cve_2026_9198 {
meta:
author = "df00tech"
description = "Detects CVE-2026-9198 IBM Langflow code injection exploitation via suspicious child process execution"
severity = "CRITICAL"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
$proc.principal.process.parent_process.file.full_path = /(?i)(langflow|uvicorn|python)/
$proc.target.process.file.full_path = /(?i)(bash|sh|powershell\.exe|cmd\.exe|curl|wget|nc|ncat)/
$proc.target.process.command_line = /(?i)(eval\(|exec\(|os\.system|subprocess|base64 -d|IEX|Invoke-Expression|0>&1)/
condition:
$proc
}Chronicle YARA-L rule detecting anomalous shell/interpreter spawning from Langflow parent processes with injection payload patterns, mapping to CVE-2026-9198 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Langflow developers testing custom Python component code that shells out intentionally
- CI/CD pipelines invoking Langflow via automation scripts that use interpreters
- Administrative maintenance scripts that restart or manage the Langflow service using shell commands
Other platforms for CVE-2026-9198
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Langflow Component Code Injection via Python eval
Expected signal: Process creation event showing python3 as parent spawning bash child process with command line containing 'echo LANGFLOW_ATOMIC_TEST_INJECTION'
- Test 2Simulate Reverse Shell Spawn from Langflow Process
Expected signal: Process and network events showing bash establishing an outbound TCP connection with redirected file descriptors (0>&1 pattern) in command line.
- Test 3Simulate PowerShell Encoded Command Execution via Langflow on Windows
Expected signal: Windows Security Event ID 4688 / Sysmon Event ID 1 showing powershell.exe launched with -EncodedCommand flag, ideally with a Langflow-related parent process (python.exe or uvicorn).
References (4)
- https://www.ibm.com/support/pages/node/7278927
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-9198
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-9198 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month