On this page
Atomicorp WAF Rule 300008
Rule Summary
- Rule ID: 300008
- Status: Active
- Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: IBM Langflow OSS unauthenticated auto-login superuser token minting attempt blocked
- Observed CWEs: CWE-22 (1), CWE-78 (1), CWE-94 (2), CWE-306 (1)
- Revision: 1
- Rule severity: Alert (1)
- Phase: 2 (request body)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: IBM Langflow OSS unauthenticated auto-login superuser token minting attempt blocked” in the request URI. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-105697 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | langflow | 9.9 (v3.1) | Critical |
| CVE-2026-9103 | Langflow OSS - Superuser Token Issuance | langflow | 9.8 (v3.1) | Critical |
| CVE-2026-9198 | Langflow AI auto_login RCE | langflow | 9.8 (v3.1) | Critical |
| CVE-2026-93674 | Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution | langflow | 9.8 (v3.1) | Critical |
| CVE-2026-5027 | Langflow <= 1.8.4 - Path Traversal to RCE via File Upload | langflow | 8.8 (v3.1) | High |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-22 | CVE-2026-5027 |
| CWE-78 | CVE-2026-105697 |
| CWE-94 | CVE-2026-9198 , CVE-2026-93674 |
| CWE-306 | CVE-2026-9103 |