Langflow CVE-2026-0770: exec_globals Enables Unauthenticated RCE — Langflow's Second CISA KEV Entry, No Patch in Sight

TL;DR — 90 seconds

Affected?

Any Langflow instance with network access to /api/v1/validate/code. The GitHub Advisory Database lists versions up to and including 1.7.3 (other trackers cite a starting point of 0.0.31, roughly 280 version tags) — whether newer releases (currently 1.9.3) are actually fixed is unconfirmed.

Risk?

Unauthenticated remote code execution (CVSS 8.9 under CVSS 4.0 / 9.8 under CVSS 3.0), typically with root privileges inside the container. Actively exploited since roughly 27 Jun 2026; KEVIntel recorded over 220 exploitation attempts from 64 distinct IPs.

Immediate action?

Restrict network access to /api/v1/validate/code immediately, or take the instance off the open internet entirely — there is no version patch to upgrade to instead.

Recommendation?

Review historical requests to the validate/code endpoint, examine host activity for reconnaissance and second-stage patterns, and treat every secret reachable from the Langflow host as potentially compromised and rotate it.

Criticality?

critical (hero badge) — unauthenticated, full RCE, active exploitation, CISA KEV entry, no confirmed patch.

What is the problem?

Langflow is a visual builder for AI agent workflows that, among other things, exposes an /api/v1/validate/code endpoint letting users check Python snippets for custom components for syntax errors from the frontend. That validation is implemented server-side in the validate_code() function. The problem: alongside the code to check, the function also accepts an exec_globals parameter and passes its contents unfiltered into Python's built-in exec() function. exec() runs arbitrary Python code inside the namespace it's given — whoever controls the contents of exec_globals controls what runs on the server. Because the endpoint requires no authentication, any attacker with network access to the instance can inject arbitrary code, running with the privileges of the Langflow process — root in many container images.

The flaw is classified as CWE-829 ("Inclusion of Functionality from Untrusted Control Sphere") and was reported to the vendor on 18 Jul 2025. According to the Zero Day Initiative, there was no response for months (follow-ups on 11 Sep 2025 and 10 Oct 2025, notice of intent to publish as a 0-day on 10 Dec 2025); the public advisory followed on 9 Jan 2026 (ZDI-26-036) and 22–23 Jan 2026 (NVD/GitHub Advisory Database), last updated 19 Feb 2026. The ZDI advisory itself states that the "only salient mitigation strategy" is restricting interaction with the product — an implicit signal that no fix existed at the time of publication.

Important context: this is a different vulnerability from CVE-2026-55255 (IDOR, authenticated cross-tenant flow execution) and CVE-2026-5027 (file-upload path traversal), both already covered on this blog. All three affect the same platform but are technically independent bugs.

Who is affected?

CISA added the flaw to the KEV catalog on 21 Jul 2026 — a strong signal of ongoing active exploitation rather than theoretical risk alone. Threat-intel firm KEVIntel observed the first attacks as early as around 27 Jun 2026, recording over 220 exploitation attempts from 64 distinct IPs by the time of the KEV addition.

Impact

The immediate impact is full remote code execution with no authentication whatsoever — in practice the worst case a web application can suffer. Because the Langflow process runs with root privileges inside the container in many deployments, an attacker effectively gains full control of the host or container: reading and writing arbitrary files, launching arbitrary processes, and accessing every environment variable — and with it every API key, database credential, and cloud credential configured in Langflow. According to attacks documented by threat-intel firm KEVIntel, observed post-exploitation activity included command-execution checks to verify the flaw, system reconnaissance, loading of second-stage scripts, and targeted harvesting of credentials and cloud metadata (including AWS credentials).

Because Langflow frequently serves as an orchestration layer for AI agents with access to downstream systems, databases, and external APIs, the blast radius potentially extends far beyond the Langflow instance itself: any secret a compromised Langflow host could reach must be treated as potentially exfiltrated, regardless of whether concrete misuse can be proven after the fact.

Mitigation / immediate steps

Note: As of this writing, no vendor-confirmed patch exists for CVE-2026-0770. The steps below therefore focus on access restriction, monitoring, and damage control rather than a version upgrade — verify against the current Langflow security advisories before implementing in case the situation has changed.

Operational decision block

• Act today if … your Langflow instance is reachable from the internet or an untrusted internal network and you have not already restricted access to /api/v1/validate/code.
• Check with priority if … you are a US federal agency or supplier — CISA's remediation deadline for this KEV addition was 24 Jul 2026.
• Monitor only if … your instance demonstrably allows no network access from outside a tightly controlled, trusted segment.

Step 1 — restrict access to the vulnerable endpoint

# restrict network access to the Langflow instance to trusted sources (firewall/security group)
# put a reverse proxy with enforced authentication in front of the instance,
# especially for /api/v1/validate/code
# if the code-validation feature is not strictly required:
# block the route at the reverse-proxy level, e.g. with nginx:
location /api/v1/validate/code {
    deny all;
    return 403;
}

Step 2 — host and log review

# review historical requests to the validate endpoint (see Detection section)
# check running and recently terminated Langflow service processes for unknown child processes
ps auxf | grep -i langflow
# check outbound connections from the Langflow host for unknown destinations (possible second-stage downloads)
ss -tnp | grep langflow

Step 3 — rotate credentials

# rotate every secret reachable from the Langflow host or any environment it could reach:
# - API keys for LLM providers and other third-party services
# - database credentials
# - cloud credentials (AWS/GCP/Azure), especially if the instance metadata service was reachable
# - local access tokens/SSH keys on the host

Step 4 — if no patch is in sight

# take the instance fully off the public network until a fix is confirmed
# alternatively: allow access only via VPN/zero-trust access with authentication
# set up monitoring/alerting for renewed access attempts against /api/v1/validate/code

Detection / verification

Check version and reachability

pip show langflow | grep Version
docker inspect <container> | grep -i langflow
# check whether the endpoint is reachable from outside at all
curl -s -o /dev/null -w "%{http_code}\n" <host>/api/v1/validate/code -X POST

Review historical requests to the vulnerable endpoint

# search access/reverse-proxy logs for requests against the validate endpoint
grep "api/v1/validate/code" access.log | awk '{print $1, $4, $7}' | sort -u
# identify suspicious payload content in the request body
grep -E "exec_globals|__import__|os\.system|subprocess|base64\.b64decode" access.log

Host-side indicators

# unexpected child processes of the Langflow service
ps auxf | grep -i langflow
# access to the cloud metadata instance (a typical target for credential harvesting)
grep "169.254.169.254" outbound.log
# unusual outbound connections shortly after requests to validate/code
ss -tnp | grep langflow

Runtime indicators

• POST requests to /api/v1/validate/code from unknown or unexpected source IPs, especially without prior authentication
• process launches by the Langflow service user that do not correspond to any known Langflow subprocess
• the Langflow process fetching external scripts/binaries (second-stage deployment)
• access to environment variables, credential files, or the cloud metadata endpoint shortly after requests to the validate endpoint

Operator guidance

Mid-market

Check immediately whether your Langflow instance is reachable from the internet or an untrusted network at all. If so: block access to /api/v1/validate/code or put it behind authentication right away, review historical logs, and rotate every secret reachable from the host — regardless of whether misuse can be proven. A version upgrade alone is not currently a viable mitigation, since no confirmed fix exists.

Enterprise

Additionally: review container hardening (avoid running the Langflow process as root wherever possible), design network segmentation so the instance has no unnecessary access to the cloud metadata service or internal systems, and move secrets management to external stores with short-lived, scope-limited tokens instead of keeping credentials directly in the Langflow host's environment. If you run multiple Langflow instances, set up centralized monitoring for the indicators listed in this post.

US federal agencies / regulated environments

The CISA KEV entry from 21 Jul 2026 is part of a six-vulnerability update spanning 21–22 Jul 2026 and carries a binding remediation deadline for federal agencies (24 Jul 2026) under CISA's BOD 22-01 program — also relevant to suppliers where contractual compliance requirements apply.

Decision block

Act today if: the Langflow instance is reachable, access to the validate endpoint is unrestricted, and there is no evidence ruling out exploitation. Monitor if: access is already strictly restricted and logs show no anomalies.

Conclusion

CVE-2026-0770 is a textbook example of how dangerous it is to pass user input unfiltered into exec() — made worse by the fact that the affected endpoint requires no authentication and, in many deployments, runs with root privileges. That the flaw was reported six months before the public advisory and, according to ZDI, received no vendor response before being published as a 0-day is remarkable in its own right; that over half a year later — despite active exploitation and a CISA KEV listing — no confirmed patch exists is more remarkable still. This is Langflow's second vulnerability in the KEV catalog within a matter of weeks. Anyone running the platform should not wait for a version upgrade, but should restrict network access to security-relevant endpoints as a matter of course and manage secrets so that compromising a single service does not automatically compromise the entire environment.

Sources

• GitHub Advisory Database — GHSA-g22f-v6f7-2hrh: Langflow affected by Remote Code Execution via validate_code() exec()
• NVD — CVE-2026-0770 Detail
• Zero Day Initiative — ZDI-26-036 (ZDI-CAN-27325)
• CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (21 Jul 2026)
• Security Affairs — U.S. CISA adds DD-WRT, Langflow and WordPress flaws to its KEV catalog
• BleepingComputer — CISA orders urgent action on actively exploited Langflow RCE flaw
• Corgea — CVE-2026-0770 vulnerability details (affected version range)
• langflow-ai/langflow — GitHub Releases (patch-status cross-check)