The New Attack Surface Is the Agent Control Plane
- Rich Washburn
- 12 minutes ago
- 5 min read
CISA dropped an alert this week that should make anyone running agentic infrastructure stop and pay attention.
Three vulnerabilities, all actively exploited, all added to the Known Exploited Vulnerabilities catalog. Federal agencies have days, not weeks, to mitigate. But this isn't three random CVEs arriving at the same time by coincidence. It's three different layers of modern infrastructure getting hit simultaneously — and the pattern matters more than any individual flaw.
AI workflow infrastructure: IBM Langflow. Visual framework for building AI agents. CVSS 9.8.
MSP management infrastructure: N-central by N-able. Remote monitoring and management platform. Administrative account hijack without authentication.
Mainstream application infrastructure: Apache Tomcat. One of the most widely deployed web servers on earth. Incomplete fix for a critical encryption vulnerability.
Three layers. Three control planes. All under active exploitation at the same time.
THE UGLY ONE: LANGFLOW
CVE-2026-9198 is the one that should keep you up at night if you're running AI agent infrastructure.
It's essentially an unauthenticated "become superuser, then execute Python" chain. An attacker uses one API endpoint to mint a superuser token and another endpoint to execute supplied code through Python's exec() function. Full remote code execution on exposed default deployments. No credentials required. 9.8 out of 10 on the CVSS scale.
And this isn't theoretical. In late July, multiple fully functional proof-of-concept exploits with complete instructions appeared in public space. Two weeks earlier, CISA had already alerted on another critical Langflow vulnerability — CVE-2026-0770 — being exploited for root-level remote code execution.
Here's why this matters beyond Langflow itself. These systems frequently sit next to:
API keys. Model credentials. Vector databases. Internal documents. MCP servers. Automation tools. Cloud and database connections.
So this isn't just "someone hacked the AI chatbot." A compromised Langflow instance potentially turns the orchestration layer into a credential vault, internal pivot point, and code execution platform — all at once. You're not stealing one secret. You're inheriting every connection the agent already has.
This is the part that should sound familiar if you've been watching the agentic infrastructure space. People are connecting experimental visual builders to real databases, real APIs, real files, real models, and real automation systems — and sometimes leaving the front door in its default configuration. The tool was designed for prototyping. The deployment is running production credentials.
The gap between "this is a cool demo environment" and "this is production infrastructure holding the keys to everything" has collapsed, and a lot of organizations haven't noticed.
THE MSP PROBLEM: N-CENTRAL
The N-central situation is its own kind of ugly.
The original vulnerability allowed attackers to hijack administrative accounts without authentication. The vendor patched it. The patch was insufficient. Attackers found another path. N-able warned customers on August 1st that the new exploit was actively in the wild. An emergency hotfix went out on Sunday.
For an MSP platform, administrative compromise isn't a one-system problem. It's a one-to-many supply chain event. One N-central console may manage hundreds or thousands of downstream endpoints. You compromise the console, you inherit the fleet.
That's the same architectural pattern as the Langflow problem, just at a different layer. The attacker isn't trying to hack every machine individually. They're compromising the system that already possesses permission to operate all of them.
THE NARROWER ONE: TOMCAT
CVE-2026-34486 has a high-severity score of 7.5 and stems from an incomplete fix for a critical vulnerability — CVE-2026-29146, rated 9.8, described as missing encryption of sensitive data. The bypass affects Tomcat's EncryptInterceptor.
Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor tried to exploit it in a manual campaign to plant reverse shells on nine Apache Tomcat servers. The practical exposure depends more heavily on configuration than the Langflow flaw does, but once CISA adds something to the Known Exploited Vulnerabilities catalog, debating whether the CVSS number "looks scary enough" is beside the point. It's being used. The catalog doesn't do speculative entries.
THE PATTERN: ATTACKERS ARE HUNTING CONTROL PLANES
Here's what connects all three.
The attackers aren't targeting endpoints. They're not trying to compromise individual workstations or applications one at a time. They're going straight for the systems that already possess administrative authority over everything else.
Langflow is the control plane for AI agents — it holds the credentials, the model connections, the tool integrations, the data access. N-central is the control plane for managed infrastructure — it holds administrative access to hundreds or thousands of endpoints. Tomcat is the control plane for application deployment — it runs the business software.
Compromise one exposed control plane and you inherit everything it can see, authenticate to, administer, or execute against. That's leverage. That's the difference between breaking into one house and getting the master key to the building.
This is the shift that matters. The attack surface isn't growing because we're adding more software. It's growing because we're building systems that concentrate authority — and then sometimes leaving them in default configuration on the open internet.
THE AGENT CONTROL PLANE IS THE NEW ATTACK SURFACE
The Langflow flaw reinforces something I've been circling for months: agentic infrastructure is becoming production infrastructure faster than organizations are learning to secure it.
AI agent builders aren't toys anymore. They're connected to real databases, real APIs, real model providers, real automation pipelines, real file systems. They hold the keys to the systems they orchestrate. And they're being deployed by people who are thinking about workflow design, not attack surface reduction.
That's not a criticism — it's a description of where we are. The tooling got good fast. The security model hasn't caught up.
When the orchestration layer holds the credentials for everything downstream, it becomes the highest-value target in the environment. Not the model. Not the data. The thing that connects to all of it.
The model is the brain. The data is the fuel. The control plane is the nervous system — and right now, in too many deployments, the nervous system is sitting on the open internet with the default password and a publicly available exploit.
That's the PSA.
If you're running agentic infrastructure — Langflow, anything like it, anything that connects AI agents to your real systems — treat the orchestration layer like it's the most sensitive thing in your environment. Because from an attacker's perspective, it is.
Patch. Segment. Don't expose default configurations to the internet. Audit what credentials your agent builder can actually reach. Assume that a compromise of the control plane is a compromise of everything it touches.
Because that's exactly what the attackers are assuming too.
Rich Washburn is a technologist and strategist working at the intersection of AI, infrastructure, and capital. He is Managing Partner and Chief AI Officer at Eliakim Capital.