1 article with this tag
An unauthenticated RCE in Langflow's validate endpoint (CVE-2026-0770, CWE-829). Untrusted input reaches Python exec() via the exec_globals parameter, yielding arbitrary code execution without authentication (CVSS 9.8, in CISA KEV, actively exploited). As of publication ZDI/GitHub Advisory/NVD list no fixed version; ZDI's recommended mitigation is to restrict interaction with the product. The real response is to stop exposing it — network isolation + authentication — plus updating to the latest release. Langflow has had repeat validate-endpoint RCEs, so don't rely on a single patch.