---
id: 2026-07-langflow-cve-2026-0770-exec-globals-rce
title: "Langflow CVE-2026-0770 — unauthenticated root RCE via exec_globals in validate_code(), added to CISA KEV 8+ months after report, still no patch"
date_disclosed: 2026-01-09
last_updated: 2026-07-28
severity: critical
status: active
ecosystems: [pypi, ai-agents]
tools_affected: [langflow]
tags: [cve, rce, ai-agent-framework, unauthenticated, cisa-kev, unpatched, exec]
---

## TL;DR
**CVE-2026-0770** — a **fourth**, distinct unauthenticated remote-code-execution flaw in **Langflow**, separate from the already-tracked CVE-2026-33017, CVE-2026-27966, and CVE-2026-55255. Langflow's `validate_code()` endpoint passes an attacker-controlled `exec_globals` parameter straight into Python's `exec()` with no authentication, giving a single-request, no-login **root-level RCE** (CVSS 9.8 per NVD; CVSS4 8.9 per SentinelOne). Reported to the vendor **2025-07-18** and publicly disclosed **2026-01-09** — but as of this writing **no patched version has been published**, and CISA added it to the **Known Exploited Vulnerabilities catalog on 2026-07-21/22** after observing active exploitation starting 2026-06-27.

## What happened
Trend Research (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira) found that Langflow's `validate_code()` function — reachable through the platform's `validate` API endpoint — accepts an `exec_globals` parameter and passes it directly to Python's `exec()` builtin without sanitization or authentication (CWE-829, "Inclusion of Functionality from Untrusted Control Sphere). A single unauthenticated HTTP request runs arbitrary Python with the privileges of the Langflow process — commonly root in default/container deployments.

Reported through Trend Micro's Zero Day Initiative on **2025-07-18**; ZDI's own advisory (ZDI-26-036) published **2026-01-09**, with the CVE record appearing on NVD on **2026-01-23** (last updated 2026-01-26; SentinelOne's tracker lists a 2026-01-30 publish date — sources disagree on the exact day, all agree on late January 2026). ZDI's advisory states plainly: **"the only salient mitigation strategy is to restrict interaction with the product"** — there was no fix at disclosure, and none has surfaced since. Affected versions are **≤ 1.7.3**; no patched version is listed on the GitHub Security Advisory (GHSA-g22f-v6f7-2hrh) or by any source checked for this writeup.

The flaw sat unexploited-at-scale for months until Trend Micro/KEVIntel observed **in-the-wild exploitation starting 2026-06-27** — over 220 exploitation attempts from 64 distinct source IPs, with observed post-exploitation payloads attempting to deploy malware and harvest AWS credentials, environment variables, and container metadata. CISA added CVE-2026-0770 to its KEV catalog (sources disagree on the exact day: 2026-07-21 per a researcher's X post, 2026-07-22 per BleepingComputer's writeup), triggering a Binding Operational Directive 26-04 remediation deadline for federal agencies of roughly 2026-07-24/25.

This is distinct from every other Langflow CVE already tracked in this repo:
- [CVE-2026-33017](2026-03-langflow-rce.md) — public flow-build endpoint (`build_public_tmp`), patched in 1.9.0.
- [CVE-2026-27966](2026-02-langflow-cve-2026-27966-csv-agent-rce.md) — CSV Agent's hardcoded `allow_dangerous_code=True`.
- [CVE-2026-5027](2026-06-langflow-cve-2026-5027-path-traversal.md) — unauthenticated path traversal via file upload.
- [CVE-2026-55255](2026-07-langflow-cve-2026-55255-idor-kev.md) — cross-tenant IDOR on `/api/v1/responses`.

CVE-2026-0770 predates all of them (reported mid-2025) but only reached this repo now, when active exploitation forced a KEV listing — the same "silent gap, backfilled by KEV escalation" pattern already seen with other Langflow findings.

## Am I affected?

```bash
# Check installed Langflow version (any version <= 1.7.3 is confirmed vulnerable;
# no patched version exists at time of writing, so treat ANY exposed Langflow as vulnerable)
pip show langflow 2>/dev/null | grep -E '^(Name|Version):'

# Is a Langflow instance exposed on the network?
ss -tlnp 2>/dev/null | grep -E ':7860|:7861'
ps eww | grep -i '[l]angflow'
```

If your Langflow instance has ever been reachable from anything other than `127.0.0.1`, assume compromise: check for unexpected outbound connections, unfamiliar processes, and missing/exfiltrated `.env` or credential files.

### IOCs

| Type | Value |
|---|---|
| CVE | `CVE-2026-0770` |
| GHSA | `GHSA-g22f-v6f7-2hrh` |
| ZDI ID | `ZDI-26-036` |
| CVSS | 9.8 (NVD, CVSS v3) / 8.9 (SentinelOne, CVSS v4) — critical/high either way |
| Vulnerable component | `validate_code()` — `exec_globals` parameter on the `validate` API endpoint |
| Affected versions | ≤ 1.7.3 — **no patched version published** |
| Vendor reported | 2025-07-18 |
| Public disclosure | 2026-01-09 (ZDI) / CVE on NVD 2026-01-23 |
| First itw exploitation observed | 2026-06-27 |
| CISA KEV added | 2026-07-21 / 2026-07-22 (sources disagree) |
| Post-exploit TTP | malware deployment attempts; AWS credential, env var, and container-metadata harvesting |

## If you are affected
→ [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md) — AWS keys and any credentials reachable from the Langflow host.
→ [playbooks/if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md)

## Prevention
→ [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md)
→ [prevention/credential-hygiene.md](../prevention/credential-hygiene.md)
→ Never expose Langflow's HTTP API to the public internet or an untrusted network — with **no patch available**, network isolation (bind to `127.0.0.1`, front with an authenticated reverse proxy or VPN/tunnel) is the only mitigation. Treat every Langflow instance you run the same way regardless of version number until the vendor ships a fix.

## Sources
- [NVD — CVE-2026-0770](https://nvd.nist.gov/vuln/detail/CVE-2026-0770) — canonical CVE record, CVSS 9.8, affected versions ≤1.7.3, published 2026-01-23.
- [GitHub Advisory Database — GHSA-g22f-v6f7-2hrh: Langflow affected by Remote Code Execution via validate_code() exec()](https://github.com/advisories/GHSA-g22f-v6f7-2hrh) — canonical description, CWE-829, no patched version listed.
- [Zero Day Initiative — ZDI-26-036](https://www.zerodayinitiative.com/advisories/ZDI-26-036/) — researcher credit (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira of Trend Research), vendor-report date 2025-07-18, publish date 2026-01-09, "only salient mitigation strategy is to restrict interaction with the product."
- [SentinelOne — CVE-2026-0770: Langflow exec_globals RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-0770/) — CVSS v4 8.9, EPSS 53.461% (99th percentile), affected ≤1.7.3.
- [BleepingComputer — CISA orders feds to patch actively exploited Langflow RCE flaw](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/) — KEV addition context, 220+ exploitation attempts from 64 IPs starting 2026-06-27, BOD 26-04 deadline, post-exploit credential/malware TTPs.