CVE-2026-0770

What is Langflow?

Langflow is an open-source, low-code visual builder for creating AI agent and LLM application workflows — dragging together prompts, vector stores, tools, and model calls into a working pipeline without writing full application code. Its popularity in the fast-growing "agentic AI" tooling space means many self-hosted instances run with elevated privileges to give workflows broad access to files, APIs, and cloud credentials, which makes a pre-auth code execution bug in the platform itself especially dangerous — an attacker doesn't just compromise a web app, they inherit whatever access the AI agent pipelines were built to have.

Overview

CVE-2026-0770 is an unauthenticated remote code execution vulnerability (CWE-829, inclusion of functionality from an untrusted control sphere) in Langflow's code-validation endpoint. It allows any network-reachable, unauthenticated attacker to run arbitrary Python code as root on the host, with no user interaction required. CISA added it to KEV on July 21, 2026, and coverage noted it as one of the first dedicated AI-agent-platform entries in KEV history — a marker of how quickly self-hosted LLM tooling has become a real-world attack surface rather than a theoretical one.

Affected Versions

Technical Details

The root cause is in Langflow's /api/v1/validate/code endpoint, which accepts an exec_globals parameter that is passed directly into Python's exec() inside the validate_code() function without any sandboxing or restriction on what globals/builtins are available. Because the endpoint requires no authentication, an attacker can submit a single crafted request containing malicious Python and have it executed in the Langflow process — which typically runs as root in default/container deployments (CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical). The issue was originally tracked by Trend Micro's Zero Day Initiative as ZDI-CAN-27325 / ZDI-26-036. This is a distinct bug from CVE-2026-55255, an IDOR/authorization-bypass flaw in Langflow that was added to KEV earlier and is also enriched on this site — the two are unrelated fixes in the same product.

Discovery

Reported through Trend Micro's Zero Day Initiative (ZDI-CAN-27325). Langflow has a recurring history of pre-auth, high-severity bugs, including CVE-2025-3248 (missing authentication, exploited in May 2025 JadePuffer ransomware attacks) and CVE-2026-33017 (code injection, disclosed March 2026) — a pattern consistent with a young, rapidly-shipped project whose validation/execution endpoints were not designed with hostile input in mind.

Exploitation Context

Threat intelligence firm KEVIntel recorded the first in-the-wild exploitation attempts on June 27, 2026 — nearly a month before the CISA KEV addition — logging over 220 exploitation attempts from 64 unique source IPs. Observed post-exploitation activity includes deployment of secondary malware, harvesting of AWS credentials, reading of environment variables, and pulling of container metadata to enable further lateral movement. EPSS scoring places the probability of exploitation within 30 days at roughly 53%. No specific threat actor has been named publicly.

Remediation

1. Upgrade to Langflow 1.9.0 or later immediately — there is no safe configuration for the vulnerable /api/v1/validate/code endpoint short of patching.
2. Never expose Langflow directly to the internet. Self-hosted instances should sit behind authentication at the network layer (VPN, reverse proxy with SSO) regardless of patch status, since agent-building platforms are attractive targets for credential and pipeline theft.
3. Rotate all credentials accessible to the Langflow host if it was internet-facing and unpatched prior to the fix, especially cloud provider keys, API tokens for connected LLM providers, and any database credentials used by workflows.
4. Audit for unexpected outbound connections or processes spawned by the Langflow service account, and review logs for POST requests to /api/v1/validate/code with unusual exec_globals payloads.
5. Review container/host isolation for Langflow deployments — since the process commonly runs as root, treat any compromise as a full host compromise and rebuild from a clean image rather than attempting to clean in place.