Skip to content

Langflow CVE-2026-0770 exploitation

Summary

CVE-2026-0770 is a pre-authentication remote-code-execution vulnerability in Langflow's handling of the exec_globals parameter supplied to a validation endpoint. The Zero Day Initiative describes successful exploitation as arbitrary code execution in the context of the Langflow process, potentially root. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-21 with a 2026-07-24 remediation due date.

The flaw was fixed in Langflow 1.9.0. CISA's addition changes the operational posture from vulnerability management to active-exploitation triage for systems that exposed a vulnerable Langflow service. KEVIntel subsequently reported 137 attempts from 46 source addresses across 17 countries since 2026-06-27, including credential and environment discovery plus second-stage malware delivery attempts.

Tags

Technical scope

  • Attack surface: the exec_globals parameter provided to Langflow's validation endpoint.
  • Access required: none according to the ZDI/CVE description.
  • Impact: arbitrary code execution in the Langflow process context; ZDI reports possible execution as root.
  • Severity: CVSS 3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
  • Fix: Langflow 1.9.0, whose release notes identify the relevant fix as preventing RCE through the data parameter in the build_public_tmp endpoint.
  • CISA deadline: 2026-07-24 under the catalog entry's BOD 26-04 guidance.

Public exploitation telemetry

  • KEVIntel first observed in-the-wild activity on 2026-06-27.
  • Its sensors recorded 137 attempts from 46 unique source addresses associated with 17 countries; 75 attempts from 20 addresses occurred during the seven days before the July 22 report.
  • Payloads included id / whoami checks, /etc/passwd reads, environment-variable collection, AWS credential and container-metadata discovery, and wget / curl retrieval followed by shell-script execution of second-stage payloads.
  • The public report did not name the downloaded malware, list infrastructure, identify victims, or attribute an actor. Sensor counts confirm active abuse but do not measure total internet activity or successful compromise.

Do not merge this activity with other Langflow campaigns solely because they target the same product.

Detection and triage

  • Inventory internet-facing and internally shared Langflow deployments and confirm the running version, container image digest, and deployment date.
  • Search reverse-proxy, API-gateway, WAF, and application logs for unauthenticated validation or build_public_tmp requests containing unusual exec_globals or data structures.
  • Hunt the Langflow host or container for child shells, interpreters, download utilities, new files, changed startup commands, unexpected outbound connections, and access to environment variables or mounted credentials.
  • Review container runtime and orchestrator telemetry for exec, shell, package-manager, credential-discovery, service-account, secret-read, or lateral-movement activity originating from Langflow workloads.
  • Preserve request bodies, application logs, container layers, process trees, network telemetry, and cloud/orchestrator audit logs before cleanup.

Response guidance

  1. Upgrade to Langflow 1.9.0 or a newer supported release and verify that all replicas and stale images were replaced.
  2. Remove public access where it is not explicitly required. Put authentication and network controls in front of remaining deployments.
  3. Treat vulnerable prior exposure as a compromise-assessment trigger; patching does not remove code already executed through the endpoint.
  4. If exploitation is plausible, isolate and rebuild the workload from a trusted image. Rotate API keys, model-provider keys, database credentials, cloud tokens, service-account credentials, and other secrets readable by the Langflow process after containment.
  5. Scope adjacent AI, data, vector-store, source-control, and cloud systems reachable from the workload.

Sources