Unit 42’s reporting on the DeepSeek-powered autonomous exploitation campaign confirms what defenders have been slow to account for: AI workflow platforms — Langflow, n8n, Flowise, and similar tooling — are now actively targeted infrastructure. CVE-2026-9198, an unauthenticated remote code execution vulnerability in Langflow (CVSS 9.8), enabled exploitation of 460-plus targets in a campaign that additionally pivoted to n8n when Langflow instances resisted. CISA added CVE-2026-9198 to KEV on August 5, 2026.

This guide covers where detection opportunities exist across the attack chain, with deployable Sigma rules and KQL.

The Attack Surface

Langflow and n8n share characteristics that make detection both necessary and tractable:

  • Both expose HTTP APIs and web interfaces, often on non-standard ports
  • Langflow defaults to port 7860; n8n defaults to port 5678
  • Both execute code or external integrations as part of their workflow engines
  • Both typically run as a service user on Linux hosts, or as a container process

The CVE-2026-9198 exploit is an unauthenticated HTTP request to Langflow’s API that results in server-side code execution. Post-exploitation behaviour mirrors standard Linux post-exploitation: reconnaissance commands, credential harvesting from config files, lateral movement toward connected databases and API endpoints.

Detection Layer 1: Web Server Access Logs

The first detection opportunity is in HTTP access logs, if you’re collecting them from your AI platform servers.

Exploit attempts against CVE-2026-9198 target specific API endpoints in Langflow’s /api/v1/ path. POST requests to /api/v1/process/ or /api/v1/build/ from external IP addresses with unexpected content types or oversized payloads are a primary indicator.

Sigma rule — Langflow exploitation attempt via web logs:

title: Langflow CVE-2026-9198 Exploitation Attempt
id: a3f1c892-7e44-4bcd-9012-ef88d3a91c07
status: experimental
description: Detects POST requests to Langflow API endpoints consistent with CVE-2026-9198 exploitation
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
      - '/api/v1/process/'
      - '/api/v1/build/'
      - '/api/v1/run/'
    c-port:
      - 7860
      - 80
      - 443
  filter_internal:
    c-ip|cidr:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
  condition: selection and not filter_internal
falsepositives:
  - Legitimate external API clients if Langflow is intentionally internet-exposed
level: high
tags:
  - attack.initial_access
  - attack.t1190

Detection Layer 2: Process Execution from Workflow Services

The most reliable detection for successful exploitation is process execution spawned by the Langflow or n8n service user. These platforms do not normally spawn shell processes or system utilities as part of legitimate workflow execution.

Sigma rule — Unexpected process spawn from AI workflow platform:

title: AI Workflow Platform Spawns Shell or System Process
id: 7b2e4f91-3c55-4d8a-b6a1-9c73e05f2d44
status: experimental
description: Detects shell or system process execution spawned by Langflow or n8n service accounts, indicating potential post-exploitation activity
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentUser|contains:
      - 'langflow'
      - 'n8n'
      - 'flowise'
    ParentImage|contains:
      - 'python'
      - 'node'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python3'
      - '/id'
      - '/whoami'
      - '/ifconfig'
      - '/ip'
  condition: selection_parent and selection_child
falsepositives:
  - Langflow or n8n workflows legitimately configured to execute shell commands (audit and restrict)
level: high
tags:
  - attack.execution
  - attack.t1059.004

Detection Layer 3: Credential File Access

Post-exploitation on AI workflow servers is particularly damaging because these services store credentials in accessible configuration files — API keys for LLM providers (OpenAI, Anthropic, Cohere), database connection strings, and integration tokens.

Watch for access to sensitive paths by the workflow service process:

title: AI Workflow Service Reads Credential or Config Files
id: 9d3f7a12-c841-4f6e-8b2e-5e01d84a7f3c
status: experimental
description: Detects a Langflow or n8n process accessing known credential storage paths
logsource:
  category: file_access
  product: linux
detection:
  selection:
    User|contains:
      - 'langflow'
      - 'n8n'
    TargetFilename|contains:
      - '.env'
      - 'credentials'
      - 'secrets'
      - '.langflow'
      - '/root/'
      - 'id_rsa'
      - 'id_ed25519'
  condition: selection
falsepositives:
  - Service startup reading its own .env configuration file
level: medium
tags:
  - attack.credential_access
  - attack.t1552.001

Detection Layer 4: KQL for Azure Sentinel / Microsoft Defender

If your AI workflow servers report to Defender for Endpoint or you’re ingesting their logs via Azure Monitor:

// Detects shell spawning from AI workflow platform processes
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessAccountName has_any ("langflow", "n8n", "flowise")
    or InitiatingProcessCommandLine has_any ("langflow", "n8n")
| where FileName in ("bash", "sh", "dash", "curl", "wget", "python3", "id", "whoami")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc
// Detects inbound POST requests to Langflow API from external addresses
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where LocalPort in (7860, 5678)
| where RemoteIPType == "Public"
| where InitiatingProcessCommandLine has_any ("langflow", "n8n")
| project TimeGenerated, DeviceName, RemoteIP, LocalPort, InitiatingProcessCommandLine
| order by TimeGenerated desc

What to Hunt for Now

If you have internet-exposed Langflow or n8n instances, run the following retrospective hunt against your logs for the period July 1–August 10, 2026:

  1. Unexplained outbound connections from AI workflow servers — lateral movement and C2 beacon activity. Focus on DNS lookups and TCP connections initiated by the service process to external infrastructure.
  2. New cron jobs or systemd units — persistence mechanisms added by post-exploitation tooling.
  3. Access to SSH keys or cloud provider credential files — /root/.ssh/, ~/.aws/credentials, ~/.config/gcloud/, Azure service principal JSON files.

AI workflow platforms are high-value pivot points: they connect to LLM APIs, internal databases, document stores, and external SaaS integrations. Treat a compromise of your Langflow or n8n instance with the same urgency as a compromised database server.

References