The Langflow Patch Deadline Is Today. Singapore Reported Active Exploitation Yesterday

SINGAPORE, 7 AUG 2026 — The federal deadline to remediate the Langflow flaw falls today. On 6 August, the day before it, Singapore's Cyber Security Agency reported that attackers are actively exploiting it.

CISA allowed three days. The exploitation arrived inside that window.

What is being exploited

Langflow is an open-source low-code tool for building AI agents and other AI applications. CVE-2026-9198 is a code injection flaw in it, scored 9.8 out of 10 on CVSS v3.1.

Successful exploitation gives an unauthenticated attacker full remote code execution on default deployments. Not misconfigured ones. Default.

The affected range runs from 1.0.0 to 1.10.0, which is to say every release of the tool up to the fix.

We flagged this entry three days ago, for a reason that has now been tested

On 6 August we reported that every flaw CISA listed between 3 and 5 August was a tool that builds or runs other software, and argued that the Langflow entry was the one to notice.

We argued that AI workflow builders are a new product category whose purpose is to wire together model calls, data sources and code execution without writing a full application. A system designed to execute arbitrary composed logic has a much shorter path from input to code execution than a conventional application. It was also that default configuration is where most installations of a young tool sit, because the hardening guidance has not been written yet and the people deploying it are usually experimenting rather than operating.

That was an argument about category risk, offered as analysis. Two days later a national CERT reports the flaw being exploited in the wild. This does not prove the reasoning — one confirmed case of exploitation is not a validated theory of a product category. What it does match is the specific worry: the exposure named was default deployments, and the exploited condition is default deployments.

Three days, and what that combination means

The catalogue entry carries the BOD 26-04 required action together with CISA's Forensics Triage Requirements, which is the strictest combination the catalogue issues. It tells a federal agency to patch and then to go looking for evidence that it was already too late.

We reported at the start of the month that this pairing was attached to fewer than a quarter of this year's entries when we counted the catalogue on 4 August. It is attached to this one.

Three entries were added to the catalogue on 4 August and three carry a due date of today. For an organisation outside the United States federal government none of it is binding, and the signal is still the clearest one available: a three-day window plus a forensics requirement is a different statement from a twenty-one-day window asking for mitigation.

What Langflow is, for people who do not run one

The product category is central to the risk. Here is what the software actually does.

A low-code AI workflow builder gives a user a canvas on which to connect components: a model call here, a document store there, a piece of code in between, a trigger at the front. The output is a running system rather than a diagram. The appeal is that somebody who is not a software engineer can assemble something that does useful work in an afternoon.

The security consequence follows directly. A conventional web application accepts input and does a fixed set of things with it. A workflow builder accepts input and does whatever the workflow says, and the workflow is itself data the system loads. The distance between untrusted input and code execution is short by design; that speed is the entire point of the product.

This is not an argument against the category's existence. It is an argument that a code injection flaw here lands differently than in, say, a content management system, and that the blast radius is defined by what the instance was wired into rather than by what the tool itself holds.

The forensics half is the half that gets skipped

Patching Langflow closes the injection path, but it does not tell you whether anyone came through it first. The exploitation report makes that question urgent.

For a Langflow instance the questions are narrow and answerable from logs if the logs exist. Which workflows executed, and on whose instruction. Whether any flow definition changed. What credentials the instance held for the systems it orchestrates, because that is the thing an attacker would actually want — a workflow builder is wired into model providers, data sources and internal services by design.

This is why the compromise matters beyond the tool itself. An attacker is not interested in Langflow; they are interested in everything it is authorised to reach.

It was not listed alone

Three entries were added to the catalogue on 4 August, and the other two say something about the company Langflow is keeping.

The same day brought an Apache Tomcat flaw in the component that encrypts traffic between nodes of a cluster, and the second of two N-able N-central entries — a remote monitoring and management console, listed alongside the flaw that an earlier listing had bypassed. An application server's internal channel, a console that administers client machines, and a builder that executes composed AI workflows.

None of the three is software an end user opens. All three hold credentials for other systems, which was the pattern we identified across that week. Langflow is the newest product category in the group by a wide margin, and it is the one that has now been reported as exploited.

What this means in the region

There is no ASEAN equivalent of the KEV catalogue, so regional defenders read the American one and adjust for their own exposure. What CSA added here is the piece the catalogue does not carry: confirmation that exploitation is happening, published by Singapore's national CERT rather than inferred from a listing.

It is also not the only thing CSA published that week. Between 3 and 7 August the agency issued five alerts and one advisory, covering VMware products, cPanel and WHM, an endpoint security product, the npm supply chain, and this. Only one of the six is described as being actively exploited.

Any organisation in the region experimenting with agentic AI is a candidate for this. That is the uncomfortable part — the exposure sits with teams piloting a tool rather than with teams running production infrastructure, and pilots are exactly where patch discipline and logging are weakest.

What to watch

Two things.

First, is the exploitation opportunistic scanning or targeted? Nothing published so far says which, and the answer determines who should be worried.

The second is whether other AI orchestration tools follow Langflow into the catalogue. One entry is an incident. A second would make the category argument harder to dismiss.