CVE-2026-0770 — Langflow Langflow: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

1. Executive summary

CVE-2026-0770 is a CRITICAL (CVSS 9.8) unauthenticated remote code execution vulnerability in the Langflow visual framework for building AI agents and workflows. The flaw resides in the validate endpoint, where the exec_globals parameter accepts input from an untrusted control sphere, allowing remote attackers to execute arbitrary code in the context of root. The vulnerability affects Langflow versions up to and including 1.7.3. CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-07-21 with a remediation due date of 2026-07-24, confirming active exploitation in the wild. EMEA financial services running internet-exposed Langflow instances face immediate risk of full system compromise; the product's growing use in AI/ML pipelines increases the likelihood of it being present in development and staging environments.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 19 — reporting of major ICT-related incidents to competent authorities	Active exploitation of a CVSS 9.8 unauthenticated RCE on Langflow instances (CISA KEV added 2026-07-21) constitutes a major cyber threat that could compromise ICT systems.	If a Langflow instance is confirmed compromised, financial entities must classify and report the incident to competent authorities under DORA Art. 18/19 timelines.
DORA Art. 24 — digital operational resilience testing — general requirements	Langflow is an open-source AI framework increasingly embedded in financial services AI/ML pipelines; the KEV entry with a 3-day remediation deadline demands immediate vulnerability management.	Clients must incorporate this CVE into their operational resilience testing programme and verify patch status of all Langflow deployments, including development and staging environments.
NIS2 Art. 23 — incident reporting obligations	Active exploitation confirmed by CISA KEV entry; unauthenticated root-level RCE on a network-accessible service meets the threshold for significant incident reporting.	NIS2 in-scope organisations must assess whether exploitation has occurred and fulfil early (24h) and formal (72h) incident notification obligations if compromise is confirmed.

3. Technical analysis & attack chain

Vulnerability mechanism: CVE-2026-0770 (CWE-829 — Inclusion of Functionality from Untrusted Control Sphere) exists in Langflow's validate endpoint. The endpoint accepts an exec_globals parameter that is incorporated into execution context without adequate trust-boundary enforcement. Because authentication is not required (CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), any network-reachable attacker can supply a crafted exec_globals value that results in arbitrary Python code execution. The code executes in the context of the root user, yielding full system compromise.

Confirmed attack chain

Reconnaissance: Attacker identifies an internet-exposed Langflow instance (default port or reverse-proxied). Langflow is an open-source visual framework for building AI agents and workflows, commonly deployed without authentication on development servers.
Initial access: Attacker sends an unauthenticated HTTP request to the validate endpoint containing a malicious exec_globals parameter.
Code execution: The validate endpoint processes the exec_globals value, including the attacker-supplied resource into the execution context. Arbitrary Python code executes with the privileges of the Langflow process — confirmed by NVD as running in the context of root.
System compromise: With root-level code execution, the attacker achieves full system control: data manipulation, credential theft, lateral movement, and persistence are all achievable.

Affected versions: Langflow versions up to and including 1.7.3. The CPE configuration also explicitly calls out version 1.4.2.

Attribution: No threat actor attribution is available in the source material. CISA's SSVC record was updated on 2026-07-21 from exploitation: none to exploitation: active, confirming in-the-wild exploitation but without naming a specific actor. No MITRE ATT&CK actor profile is available for this activity.

Context — related Langflow CVEs in CISA KEV: This is the latest in a series of actively exploited Langflow vulnerabilities:

CVE-2026-55255 (authorization bypass through user-controlled key) — added to KEV 2026-07-07; Sysdig Threat Research Team observed active targeting used for credential harvesting. Due date was 2026-07-10.
CVE-2025-34291 (origin validation error / CORS + SameSite=None refresh token) — added to KEV; due date 2026-06-04. Enables cross-origin credential theft and full system compromise via token abuse.
CVE-2026-5027 (path traversal) — actively exploited for arbitrary file writes on exposed servers (reported by BleepingComputer).

Confidence caveat: The active exploitation status of CVE-2026-0770 is corroborated by CISA KEV entry and NVD SSVC update. The technical mechanism detail (exec_globals, validate endpoint, root context) is sourced from NVD/ZDI (ZDI-CAN-27325) — single-sourced for the endpoint and parameter specifics; verify against vendor advisory before enforcement.

4. Mitigation & containment

P1 — within 24 hours

Inventory: Identify all Langflow deployments across the estate, including development, staging, and production environments. Langflow is open-source and may be running on developer workstations or shadow IT without security team awareness.
Internet exposure assessment: Immediately remove any Langflow instance from internet-facing exposure. Place behind VPN, IP allow-listing, or an authenticated reverse proxy. The validate endpoint must not be reachable by unauthenticated network users.
Patch: Apply the vendor fix for CVE-2026-0770. The CISA KEV due date is 2026-07-24. If a patch is not yet available from the vendor, apply any vendor-supplied mitigations. If mitigations are unavailable, disable or decommission the Langflow instance until a fix is available.
Containment for suspected compromise: If any Langflow instance was internet-exposed on or before 2026-07-21, assume potential compromise. Isolate the host, preserve forensic evidence, and conduct a triage investigation per incident response procedures.

P2 — within 72 hours

Verify related CVE remediation: Ensure all Langflow instances are also patched for CVE-2026-55255 (KEV due date 2026-07-10 — should already be remediated), CVE-2025-34291 (KEV due date 2026-06-04), and CVE-2026-5027 (path traversal, actively exploited). The BSI advisory WID-SEC-2026-2030 flags multiple Langflow vulnerabilities collectively.
Network segmentation: Ensure Langflow instances are isolated from production financial systems, credential stores, and sensitive data repositories. Given root-level RCE, a compromised Langflow host can serve as a pivot point.
EDR coverage: Confirm endpoint detection and response tooling is deployed on all hosts running Langflow. Monitor for unexpected Python child processes, outbound network connections from the Langflow process, and file system modifications.

P3 — within 7 days

Authentication enforcement: Ensure all Langflow deployments have authentication enabled and configured. The unauthenticated nature of CVE-2026-0770 makes instances without authentication trivially exploitable.
Supply chain review: If Langflow is used as a component within a larger AI/ML pipeline or provided by a third-party service, confirm with the provider that they have remediated this vulnerability. Document findings under third-party risk management processes.
Post-incident review: For any instance confirmed compromised, conduct a full forensic review. Given root-level execution, examine for persistence mechanisms, credential theft, data exfiltration, and lateral movement.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
Unauthenticated HTTP requests to the `/validate` endpoint containing an `exec_globals` parameter	Web server access logs, WAF logs, network IDS	High — confirmed vulnerability mechanism (NVD/ZDI)
Python child processes spawned by the Langflow web server process with elevated (root) privileges	EDR, process monitoring, audit logs	High — confirmed root-level execution context (NVD)
Unexpected outbound network connections from a host running Langflow	Network firewall logs, NetFlow, EDR network telemetry	Medium — consistent with post-exploitation activity but not directly described in sources

6. Detection

rule Langflow_CVE_2026_0770_Validate_Exec_Globals_Request {
    meta:
        author = "Adverse Trace"
        date = "2026-07-22"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-0770"
        description = "Detects exploitation attempts targeting CVE-2026-0770 in Langflow validate endpoint via exec_globals parameter"
    strings:
        $endpoint = "/validate" ascii
        $param = "exec_globals" ascii
        $content_type = "application/json" ascii
    condition:
        $endpoint and $param
}

title: Langflow CVE-2026-0770 Exploitation - Unauthenticated Request to Validate Endpoint
id: 7a3c1f2e-2026-0722-4a80-b6c1-0adverse001
status: experimental
description: Detects unauthenticated HTTP requests to the Langflow validate endpoint containing the exec_globals parameter, indicating exploitation of CVE-2026-0770.
author: Adverse Trace
date: 2026/07/22
references:

    - https://nvd.nist.gov/vuln/detail/CVE-2026-0770
logsource:
    category: webserver
    product: nginx
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains|all:

            - '/validate'
            - 'exec_globals'
    filter_auth:
        sc-status:

            - 401
            - 403
    condition: selection and not filter_auth
falsepositives:

    - Legitimate internal testing of Langflow validate endpoint (unlikely in production)
level: critical

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-0770	9.8 Critical	⚠ KEV 2026-07-21	10%	Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulner…

7. Sources

NVD, CVE-2026-0770 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-0770, 2026-07-20
CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-0770, https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770, 2026-07-21
NVD, CVE-2026-55255 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-55255, accessed 2026-07-22
Help Net Security, Attackers using Langflow flaw for credential harvesting (CVE-2026-55255), https://www.helpnetsecurity.com/2026/07/08/langflow-vulnerability-cve-2026-55255-exploited/, 2026-07-08
NVD, CVE-2025-34291 Detail, https://nvd.nist.gov/vuln/detail/CVE-2025-34291, accessed 2026-07-22
BleepingComputer, Path traversal flaw in AI dev platform Langflow exploited in attacks, https://www.bleepingcomputer.com/news/security/path-traversal-flaw-in-ai-dev-platform-langflow-exploited-in-attacks/, accessed 2026-07-22
BSI Germany, WID-SEC-2026-2030 — Langflow: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2030, accessed 2026-07-22
BSI Germany, WID-SEC-2026-1898 — Langflow: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1898, accessed 2026-07-22

8. Adverse Trace position

CVE-2026-0770 is a CVSS 9.8 CRITICAL unauthenticated remote code execution vulnerability with confirmed active exploitation (CISA KEV, added 2026-07-21) and a 2026-07-24 remediation deadline. The root-level execution context and lack of authentication requirement make this trivially exploitable on any internet-facing Langflow instance. This is the fourth Langflow CVE added to CISA KEV in recent months, indicating sustained attacker interest in the platform — likely driven by its increasing adoption in enterprise AI/ML pipelines and the tendency to deploy it without authentication in development environments. EMEA financial services clients should treat this as an emergency: inventory all Langflow instances within 24 hours, remove internet exposure, and patch or decommission. The technical detail on the validate endpoint and exec_globals parameter is sourced from NVD/ZDI (ZDI-CAN-27325) — single-sourced; verify against the vendor advisory before enforcement. Adverse Trace will monitor for vendor patch release, threat actor attribution, and any emergence of IOCs or post-exploitation tooling associated with this vulnerability.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.