CVE-2026-0770

Exploited in the wild. In CISA KEV since 2026‑07‑21. No fix published yet.

CVSS 3.09.8Critical EPSS percentile99th64% chance in 30 days CISA KEVListedsince 2026-07-21, due 2026-07-24
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2026-01-23Updated 2026-07-22Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your Langflow instance is reachable from the internet or any untrusted network (especially the validate endpoint).
Confirm whether any external system or users can send requests that include the exec_globals parameter to the validate endpoint.
If it is reachable externally, immediately restrict access using firewall/network rules so only trusted IPs (or your VPN/admin network) can reach Langflow.
Temporarily disable or block the validate endpoint at the reverse proxy/WAF layer if that endpoint is not required for your business operations.
Monitor for exploit attempts (unexpected validate requests and unusual exec_globals content) and preserve logs for your vendor/IT team.
Since no fixed version/patch is available yet, plan to upgrade once the vendor releases one and keep restrictions in place until then.

May need vendor or contractor work

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

What it is

From the CVE record

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

In plain language

Written by AI from the record

CVE-2026-0770 is a remote “run code on the server” flaw in Langflow that does not require a login; if your Langflow is reachable from the internet (or from other untrusted networks), you should treat it as an urgent risk.

CVE-2026-0770 is an unauthenticated remote code execution issue in Langflow’s handling of the exec_globals parameter (via the validate endpoint), where attacker-controlled values can cause inclusion of functionality from an untrusted control sphere, enabling code execution as root.

If you're affected

Full server takeover
Malware/ransomware deployment
Access to customer and business data
Total service disruption

What is it

This bug lets an attacker send a special message to Langflow that tricks it into running code on your server. It doesn’t require a login, so anyone who can reach the right network endpoint could potentially take over the whole machine.

Who is affected

This matters if you run Langflow and your server can be reached by network clients you don’t fully control. The findings state the attack does not require authentication, but the exact “reachable in default configuration” condition is not yet known.

Treat it as a risk if the validate endpoint and the exec_globals handling can be reached from the internet (or another untrusted network).

How urgent is it

This is RED because it is remote code execution with no authentication required, and the outcome described includes code execution as root. Public PoC material exists, so attackers have a practical path to try the issue.

Act immediately to restrict network reachability of the relevant endpoint(s), because there is no known patch available yet.

What to do — in detail

Confirm exposure

Identify where Langflow is running (public URL(s), internal URL(s), and reverse proxy/WAF in front of it).
From your network/hosting layer, determine whether the validate endpoint is reachable from:
- the public internet, or
- any network segment outside your company/VPN/admin environment.
Review web server / reverse proxy logs for requests to the validate endpoint and look for requests containing the exec_globals parameter (or unusual payloads around that parameter).

Check whether you’re likely affected

The findings indicate unauthenticated exploitation is possible, and the vulnerable behavior is tied to exec_globals handling on the validate endpoint.
The findings do not provide an exact “affected version range” or confirmation that default configurations are exposed, so your practical risk depends on reachability and whether external users/systems can call that endpoint with exec_globals.

Immediate mitigation (compensating controls since no patch is known)

Network restrict Langflow:
- Allowlist only trusted IPs (office/VPN/NOC) to reach Langflow.
- Deny all other inbound access to the Langflow server.
Block/disable the validate endpoint if not needed:
- Configure your reverse proxy/WAF to block requests to the validate endpoint path.
- If your business requires it, restrict it to trusted networks only.
Reduce attack surface in the same place you enforce access:
- Apply the restrictions at the edge (firewall/WAF/reverse proxy), not only within the application.

After mitigation: what to monitor

Continued requests to the validate endpoint from unexpected IPs.
Spikes in 4xx/5xx responses around validate.
Any evidence of post-exploitation activity (new processes, unexpected outbound connections, new admin users, or changes to application files).

Patch status

No fixed version/patch information is available in the provided findings. Keep the compensating controls active until Langflow releases an official fix, then upgrade promptly.

CISA due date

KEV listing for this specific CVE is not present in the provided findings, so no CISA due date can be asserted here.

Technical context

What’s happening

Vulnerability type: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
Mechanism: Langflow’s handling of the exec_globals parameter (provided to the validate endpoint) can lead to inclusion of functionality from an untrusted control sphere, enabling arbitrary code execution.

Impact

The findings describe the capability as remote code execution as root, with a critical severity rating in the provided context.

Attack requirements / reachability

Authentication is not required (PR:N, UI:N per provided context).
Whether this is reachable in default configuration is not known from the findings; practical exposure depends on whether the validate endpoint and exec_globals handling are reachable from an attacker-controlled network.

Exploitation status and maturity

CISA KEV: not listed for CVE-2026-0770 in the provided findings.
Public PoC: exists (one known).
Press/real-world: the provided news finding does not claim a clear dated public exploitation report for this exact CVE; however, rising advisory attention is noted.

EPSS

A predicted likelihood is provided in the findings, but public blocks should not rely on it when exploitation-related signals exist. (No KEV confirmation is provided for this CVE in the findings.)

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-07-21.

US federal agencies must remediate by 2026-07-24.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

64% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 229 days, from the signal feeds we watch.

2026-09-09Analysis publishedIBM Filed Eight More Langflow CVEs Yesterday. That's 111 in Five Months.
2026-07-22EPSS band changemoderate → highepss band change, record updated
2026-07-21Added to CISA KEVrecord updated
2026-06-25OpenVAS check added
2026-03-07Public exploit / PoCsource: github-poc
2026-03-06Nuclei check added

Affected products

Langflowcommercialaka langflow desktop, langflow-base
- LangflowSaaSAI / ML / ai-agent-tooling
PyPIpackage-ecosystem
- langflowOSS Libraries

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable