Cyber Threat Brief — August 5 2026
⚠️ This report is AI-generated. Always validate findings.
1. Langflow Auto-Login to SUPERUSER exec() — CVE-2026-9198
TL;DR: Langflow’s 5th exploited-ITW RCE of 2026 chains /api/v1/auto_login (mints SUPERUSER tokens without authentication) with /api/v1/validate/code (passes attacker Python to exec()). CISA KEV added August 4. Default installs are fully exposed.
What’s New:
- CVE-2026-9198 (CVSS 9.8) affects Langflow 1.0.0 through 1.10.0; fixed in 1.10.1 (July 2026)
- Two-endpoint chain:
auto_logingrants SUPERUSER JWT →validate/coderuns arbitrary Python viaexec()— no exploit complexity - CISA KEV addition August 4 citing confirmed active exploitation
- 5th Langflow RCE exploited in the wild this year (after CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, CVE-2026-0770)
- Default
AUTO_LOGIN=trueconfiguration exposes all deployments without explicit hardening
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /api/v1/auto_login from external IP | Exploitation indicator | T1190 | WAF/reverse proxy | Block — unauthenticated token minting |
POST /api/v1/validate/code with Python payload | Code execution | T1059.006 | WAF/reverse proxy, application logs | Block — inspect for exec()/import in body |
| New cron entries, SSH keys, outbound connections on Langflow hosts | Post-exploitation | T1053.003, T1098.004 | Sysmon, auditd, EDR | Hunt — common post-exploitation artifacts |
| Langflow instances exposed to internet | Attack surface | T1190 | Shodan/asset inventory | Remediate — place behind authenticating reverse proxy |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Suspicious Process Spawned by Web Server (generic) | No Langflow-specific endpoint or auto_login detection |
| Elastic | Linux Suspicious Child Process From Web Server (generic) | Missing validate/code endpoint content inspection |
| Sigma | proc_creation_lnx_susp_child_process_from_web_server.yml (generic) | No WAF-layer rule for auto_login → validate/code chain |
Sources: CISA KEV · SentinelOne · The Hacker News · GHSA-c995-4fw3-j39m
2. Apache Tomcat EncryptInterceptor Regression → Unauthenticated Deserialization RCE — CVE-2026-34486
TL;DR: A regression in Tomcat’s fix for CVE-2026-29146 (CBC padding oracle) accidentally makes EncryptInterceptor fail-open, letting unauthenticated attackers send Java deserialization payloads to the Tribes clustering port (4000/TCP) for RCE. Multiple public PoCs. CISA KEV added August 4.
What’s New:
- CVE-2026-34486 (CVSS 7.5) — refactoring shifted a method call outside a try block; decryption failures no longer drop messages
- Affected versions: Tomcat 11.0.20, 10.1.53, 9.0.116 (the specific “fix” releases for CVE-2026-29146)
- Fixed in 11.0.21, 10.1.54, 9.0.117
- Three public GitHub PoCs (striga-ai, 404-src, AirSkye) deliver CC6 gadget chain payloads to port 4000
- CISA KEV addition August 4 citing active exploitation
- Pre-requisite: Tribes clustering with EncryptInterceptor must be enabled (common in clustered/load-balanced deployments)
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Inbound connections to TCP/4000 from external IPs | Exploitation indicator | T1190 | Firewall, netflow | Block — Tribes port should never be internet-exposed |
| Java deserialization payload (Commons Collections gadget chain) | Exploitation payload | T1059 | IDS/IPS (Snort/Suricata) | Detect — signature for CC6/CC7 serialized objects |
| Tomcat child processes (shell, curl, wget) | Post-exploitation | T1059.004 | Sysmon, auditd, EDR | Hunt — Tomcat spawning unexpected children |
/tmp/pwned or similar PoC artifacts | PoC indicator | T1059 | File integrity monitoring | Hunt — common PoC drop file |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Web or Application Server Spawning a Shell (generic) | No rule for Tribes port (4000/TCP) deserialization attack |
| Elastic | Java Deserialization Exploitation Attempt (partial) | Missing Tribes-specific network detection |
| Sigma | Suspicious Java Process Spawning Shell (generic) | No network-layer rule for EncryptInterceptor bypass payloads |
Sources: CISA KEV · SOCRadar · striga-ai PoC · Apache Security
Status Updates
- CVE-2026-18556/18577 (N-able N-central): CISA KEV added CVE-2026-18556 August 4 alongside CVE-2026-18577 (added August 3). Federal deadline August 6 (TOMORROW). Exploitation via Take Control + Cloudflared persistence ongoing. Yesterday’s brief.
- CVE-2026-15409/15410 (SonicWall SMA1000): INC ransomware exploitation wave continues. Resecurity documents 885+ victims as of August 2. TOTP seed theft enables persistent access. Yesterday’s brief.
- CVE-2026-20316 (Cisco FMC): Federal KEV deadline passed August 1. Zero-day exploitation via hardcoded static credential ongoing. No new artifacts. Original brief.
- CVE-2025-68686 (FortiOS): Symlink persistence bypass. Federal KEV deadline August 10 approaching. No new artifacts. Original brief.
- CVE-2026-6875 (ServiceNow): Active exploitation entering fourth week. Two sandbox-escape gadget chains. Fortune 500 victims. Still not on CISA KEV. Original brief.