Threat feed
CVE-2026-0770 — Unauthenticated remote code execution in Langflow (explainer & fixes)
CVE-2026-0770: an unauthenticated RCE in Langflow's validate endpoint — untrusted code runs via the exec_globals parameter (CVSS 9.8, actively exploited, CISA KEV). As of publication no fixed version is listed, so the real control is to stop exposing it (isolation + authentication) plus updating to the latest release.
A defensive advisory for vulnerabilities with confirmed in-the-wild exploitation (listed in CISA KEV). What happens, what's affected, and how to respond — with no attack how-to or proof-of-concept.
- CVE
- CVE-2026-0770 (inclusion of functionality from an untrusted control sphere, CWE-829)
- Severity
- Critical (CVSS 9.8) — actively exploited (CISA KEV)
- Type
- Unauthenticated remote code execution (RCE) in the validate (code-check) endpoint
- Impact
- Arbitrary code execution without auth (root in many deployments), credential/cloud-metadata theft, lateral movement
- Affected
- Langflow 1.7.3 and earlier
- Real fix
- Stop exposing it (network isolation + authentication) + update to the latest release
Why not-fixing is dangerous
Because root-level code execution is reachable without authentication, public Langflow instances are hit en masse by blind scanning. Per reporting and threat intelligence, in-the-wild exploitation was observed from around 2026-06-27, and before CISA added it to the KEV catalog, over 220 exploitation attempts from 64 unique source IPs were recorded. Observed behavior included command-execution checks, system reconnaissance, fetching additional scripts, and attempts to access credentials and cloud metadata. If it was internet-reachable, treat it as compromised.
What's affected
| Item | Detail |
|---|---|
| Target | Langflow (visual builder for AI agents/flows) |
| Affected versions | 1.7.3 and earlier (the range in NVD/ZDI/GitHub Advisory) |
| Fixed version | No fixed version stated by the coordinating sources as of publication (ZDI's advice: restrict interaction with the product). Update to the latest release, but make isolation + authentication the primary control |
| Precondition | No authentication required (unauthenticated) |
| Reachable impact | Arbitrary code execution (RCE) → server takeover, credential/metadata theft, lateral movement |
| Status | Actively exploited (CISA KEV) |
A note on the differing severity scores (both sides)
Severity differs slightly by source. NVD and ZDI (ZDI-26-036) rate it CVSS 9.8 under CVSS 3.x, while the GitHub Advisory rates it 8.9 under CVSS 4.0. That is just a difference in scoring version; both agree it is worst-class — no authentication, low complexity, arbitrary code execution. Regardless of the exact number, the response is the same: stop exposing it and update.
This is a recurring class of flaw (important)
Langflow's validate / code-execution endpoints have had prior unauthenticated RCEs added to the KEV catalog (CVE-2025-3248), and for a separate Langflow flaw, a supposedly "fixed" version was reported to remain exploitable. Do not assume "we updated, so we're safe." Update, yes — but make network isolation, authentication, and least privilege the standing primary controls.
How to respond
Stop internet exposure (top priority, the real fix)
Update to the latest release (but don't rely on the patch alone)
Check for compromise (assume it was exposed)
Run it least-privileged and shrink the attack surface
Machine-monitor CVEs and update fast
This site's take: tools that execute code default to 'not exposed'
At its core, this is less about one bug than about exposing a tool that executes code by design to an untrusted network. AI-agent builders and low-code platforms often carry arbitrary code execution as a premise in exchange for convenience — and an "internal testing" instance quietly becomes internet-facing. The single update is mandatory, but what pays off long-term is a default of "dev/testing code-execution tools never touch the internet," plus a routine that machine-monitors self-hosted CVEs and blocks them fast. See also our AI-era security checklist.
Read next
- Glossary: what RCE (remote code execution) is / what a CVE is / what SSRF is
- Practice: the CVE remediation playbook (machine-monitor and block fast) / an organization's security baseline (reduce exposure, least privilege)
- All alerts: vulnerability alerts
FAQ
QWhat does CVE-2026-0770 let an attacker do?
In Langflow's code-check (validate) endpoint, untrusted input passed via the exec_globals parameter is executed directly by Python's exec(). An unauthenticated attacker can therefore run arbitrary code (as root in many deployments), leading straight to server takeover, theft of credentials and cloud metadata, and pivoting to other systems. CVSS 9.8, with confirmed in-the-wild exploitation (CISA KEV).
QWhat's the surest fix?
Take Langflow off the internet — network isolation plus mandatory authentication is the top-priority real fix. Langflow is a tool that executes code by design, so exposing it to an untrusted network is the root risk. Update to the latest release as well, but note that as of publication ZDI, the GitHub Advisory, and NVD do not name a fixed version (ZDI's recommendation is to 'restrict interaction with the product'), and Langflow has a history of validate-endpoint RCEs reported as 'still exploitable even in a fixed version' — so do not rely on the patch alone.
QWhy do sources rate the severity a little differently?
NVD and ZDI (ZDI-26-036) rate it CVSS 9.8 under CVSS 3.x, while the GitHub Advisory rates it 8.9 under CVSS 4.0. The gap is just the scoring version; both agree it is worst-class — no authentication, low complexity, arbitrary code execution. Regardless of the exact number, the response is the same: stop exposing it and update.