Langflow CVE-2026-0770 — unauthenticated root RCE via exec_globals in validate_code(), added to CISA KEV 8+ months after report, still no patch

TL;DR

CVE-2026-0770 — a fourth, distinct unauthenticated remote-code-execution flaw in Langflow, separate from the already-tracked CVE-2026-33017, CVE-2026-27966, and CVE-2026-55255. Langflow's validate_code() endpoint passes an attacker-controlled exec_globals parameter straight into Python's exec() with no authentication, giving a single-request, no-login root-level RCE (CVSS 9.8 per NVD; CVSS4 8.9 per SentinelOne). Reported to the vendor 2025-07-18 and publicly disclosed 2026-01-09 — but as of this writing no patched version has been published, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-21/22 after observing active exploitation starting 2026-06-27.

What happened

Trend Research (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira) found that Langflow's validate_code() function — reachable through the platform's validate API endpoint — accepts an exec_globals parameter and passes it directly to Python's exec() builtin without sanitization or authentication (CWE-829, "Inclusion of Functionality from Untrusted Control Sphere). A single unauthenticated HTTP request runs arbitrary Python with the privileges of the Langflow process — commonly root in default/container deployments.

Reported through Trend Micro's Zero Day Initiative on 2025-07-18; ZDI's own advisory (ZDI-26-036) published 2026-01-09, with the CVE record appearing on NVD on 2026-01-23 (last updated 2026-01-26; SentinelOne's tracker lists a 2026-01-30 publish date — sources disagree on the exact day, all agree on late January 2026). ZDI's advisory states plainly: "the only salient mitigation strategy is to restrict interaction with the product" — there was no fix at disclosure, and none has surfaced since. Affected versions are ≤ 1.7.3; no patched version is listed on the GitHub Security Advisory (GHSA-g22f-v6f7-2hrh) or by any source checked for this writeup.

The flaw sat unexploited-at-scale for months until Trend Micro/KEVIntel observed in-the-wild exploitation starting 2026-06-27 — over 220 exploitation attempts from 64 distinct source IPs, with observed post-exploitation payloads attempting to deploy malware and harvest AWS credentials, environment variables, and container metadata. CISA added CVE-2026-0770 to its KEV catalog (sources disagree on the exact day: 2026-07-21 per a researcher's X post, 2026-07-22 per BleepingComputer's writeup), triggering a Binding Operational Directive 26-04 remediation deadline for federal agencies of roughly 2026-07-24/25.

This is distinct from every other Langflow CVE already tracked in this repo: - CVE-2026-33017 — public flow-build endpoint (build_public_tmp), patched in 1.9.0. - CVE-2026-27966 — CSV Agent's hardcoded allow_dangerous_code=True. - CVE-2026-5027 — unauthenticated path traversal via file upload. - CVE-2026-55255 — cross-tenant IDOR on /api/v1/responses.

CVE-2026-0770 predates all of them (reported mid-2025) but only reached this repo now, when active exploitation forced a KEV listing — the same "silent gap, backfilled by KEV escalation" pattern already seen with other Langflow findings.

Am I affected?

# Check installed Langflow version (any version <= 1.7.3 is confirmed vulnerable;
# no patched version exists at time of writing, so treat ANY exposed Langflow as vulnerable)
pip show langflow 2>/dev/null | grep -E '^(Name|Version):'

# Is a Langflow instance exposed on the network?
ss -tlnp 2>/dev/null | grep -E ':7860|:7861'
ps eww | grep -i '[l]angflow'

If your Langflow instance has ever been reachable from anything other than 127.0.0.1, assume compromise: check for unexpected outbound connections, unfamiliar processes, and missing/exfiltrated .env or credential files.

IOCs

If you are affected

→ playbooks/rotating-cloud-credentials.md — AWS keys and any credentials reachable from the Langflow host. → playbooks/if-your-local-ai-agent-was-exploited.md

Prevention

→ prevention/agent-sandboxing.md → prevention/credential-hygiene.md → Never expose Langflow's HTTP API to the public internet or an untrusted network — with no patch available, network isolation (bind to 127.0.0.1, front with an authenticated reverse proxy or VPN/tunnel) is the only mitigation. Treat every Langflow instance you run the same way regardless of version number until the vendor ships a fix.

Sources

• NVD — CVE-2026-0770 — canonical CVE record, CVSS 9.8, affected versions ≤1.7.3, published 2026-01-23.
• GitHub Advisory Database — GHSA-g22f-v6f7-2hrh: Langflow affected by Remote Code Execution via validate_code() exec() — canonical description, CWE-829, no patched version listed.
• Zero Day Initiative — ZDI-26-036 — researcher credit (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira of Trend Research), vendor-report date 2025-07-18, publish date 2026-01-09, "only salient mitigation strategy is to restrict interaction with the product."
• SentinelOne — CVE-2026-0770: Langflow exec_globals RCE Vulnerability — CVSS v4 8.9, EPSS 53.461% (99th percentile), affected ≤1.7.3.
• BleepingComputer — CISA orders feds to patch actively exploited Langflow RCE flaw — KEV addition context, 220+ exploitation attempts from 64 IPs starting 2026-06-27, BOD 26-04 deadline, post-exploit credential/malware TTPs.