Skip to content

Langflow CVE-2026-0770 exploitation

Summary

CVE-2026-0770 is a pre-authentication remote-code-execution vulnerability in Langflow's handling of the exec_globals parameter supplied to a validation endpoint. The Zero Day Initiative describes successful exploitation as arbitrary code execution in the context of the Langflow process, potentially root. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-21 with a 2026-07-24 remediation due date.

The flaw was fixed in Langflow 1.9.0. CISA's addition changes the operational posture from vulnerability management to active-exploitation triage for systems that exposed a vulnerable Langflow service.

Tags

Technical scope

  • Attack surface: the exec_globals parameter provided to Langflow's validation endpoint.
  • Access required: none according to the ZDI/CVE description.
  • Impact: arbitrary code execution in the Langflow process context; ZDI reports possible execution as root.
  • Severity: CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
  • Fix: Langflow 1.9.0, whose release notes identify the relevant fix as preventing RCE through the data parameter in the build_public_tmp endpoint.
  • CISA deadline: 2026-07-24 under the catalog entry's BOD 26-04 guidance.

Public sources reviewed for this update did not provide the exploitation infrastructure, payload family, victim scope, or actor attribution. Do not merge this activity with other Langflow campaigns solely because they target the same product.

Detection and triage

  • Inventory internet-facing and internally shared Langflow deployments and confirm the running version, container image digest, and deployment date.
  • Search reverse-proxy, API-gateway, WAF, and application logs for unauthenticated validation or build_public_tmp requests containing unusual exec_globals or data structures.
  • Hunt the Langflow host or container for child shells, interpreters, download utilities, new files, changed startup commands, unexpected outbound connections, and access to environment variables or mounted credentials.
  • Review container runtime and orchestrator telemetry for exec, shell, package-manager, credential-discovery, service-account, secret-read, or lateral-movement activity originating from Langflow workloads.
  • Preserve request bodies, application logs, container layers, process trees, network telemetry, and cloud/orchestrator audit logs before cleanup.

Response guidance

  1. Upgrade to Langflow 1.9.0 or a newer supported release and verify that all replicas and stale images were replaced.
  2. Remove public access where it is not explicitly required. Put authentication and network controls in front of remaining deployments.
  3. Treat vulnerable prior exposure as a compromise-assessment trigger; patching does not remove code already executed through the endpoint.
  4. If exploitation is plausible, isolate and rebuild the workload from a trusted image. Rotate API keys, model-provider keys, database credentials, cloud tokens, service-account credentials, and other secrets readable by the Langflow process after containment.
  5. Scope adjacent AI, data, vector-store, source-control, and cloud systems reachable from the workload.

Sources