{"id":"CVE-2026-0770","kind":"vulnerability","aliases":["CVE-2026-0770"],"related":[],"title":"Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability","description":"Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Langflow runs user-supplied Python with exec() in its code validation path (validate_code, exec_globals), which gives remote code execution, as root in some deployments. ZDI rates it CVSS 9.8 with no authentication needed. A public PoC exists and CISA lists it as exploited. Affected: all versions up to and including 1.7.3. No fixed version is named in the advisories I read.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-07-21T00:00:00+00:00","products":[{"name":"Langflow Langflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"langflow","fixed":[],"affected":"<= 1.7.3","ecosystem":"pypi"},{"name":"langflow","fixed":[],"affected":"<= 1.7.3","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-agents","ai-tooling","exploited","langflow","poc-public","rce","self-hosted"],"not_affected_if":["managed-hosting","not-internet-exposed"],"how_to_check":"Run 'pip show langflow' or 'docker image inspect' to get the version; <= 1.7.3 is affected. Then check exposure: if the instance answers on /api/v1/validate/code, /api/v1/custom_component, /api/v1/webhook/{flow_id} or /api/v1/build_public_tmp/{flow_id}/flow from untrusted networks, it is exposed. The PoC README says the default AUTO_LOGIN=true bypasses authentication, so check LANGFLOW_AUTO_LOGIN. Look in logs for POST requests to those endpoints, and for child processes spawned by the Langflow service or unexpected outbound connections.","fix":"No fixed version is confirmed. GitHub advisory lists patched versions as none. Cal-CSIC reports that Langflow release notes recommend upgrading to the latest version; 1.8.0 (github.com/langflow-ai/langflow/releases/tag/v1.8.0) is a later release, but I did not verify it fixes this CVE. Meanwhile: take the instance off the internet or allowlist management networks, put an authenticating reverse proxy in front, set LANGFLOW_AUTO_LOGIN=false, run as non-root, and rotate any API keys or secrets stored on exposed instances.","status":"open","published_at":"2026-01-23T04:16:04+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:35+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T20:33:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or update per the vendor instructions; the sources do not name the fixed version. If no mitigation is available, discontinue use of the product per CISA BOD 26-04 guidance.","summary":"Langflow, an open-source visual builder for AI agent and LLM workflows, includes functionality from an untrusted control sphere that lets remote attackers run arbitrary code on affected installations. CISA lists it as actively exploited in the wild.","category":"ai-tooling","who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.75,"analyst_note":"Find the vendor advisory and fixed version for CVE-2026-0770 and the exact vulnerable endpoint or configuration to check; the CISA KEV entry gives no version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000381,"input_tokens":2201,"output_tokens":322,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and fixed version for CVE-2026-0770 and the exact vulnerable endpoint or configuration to check; the CISA KEV entry gives no version range.","search":"'-04':143C,169C,200C '-0770':17A,20A '-2026':16A,19A '1.7.3':93B '26':142C,168C,199C '9.8':71B 'accord':132C 'action':128C 'adher':196C 'advisori':101B 'affect':86B,124C 'agent':27B 'ai':26B,29B 'ai-ag':25B 'ai-tool':28B 'allow':116C 'appli':129C 'applic':166C 'arbitrari':121C 'asset':190C 'attack':118C 'authent':74B 'base':147C 'bod':141C,167C,198C 'cisa':81B,126C,139C,156C 'cloud':172C 'code':12A,50B,54B,60B,122C 'complianc':137C 'contain':105C 'control':9A,112C 'cve':15A,18A 'cvss':70B 'deploy':66B 'discontinu':175C 'ensur':136C,195C 'evalu':188C 'exec':2A,47B,55B 'execut':13A,61B,120C 'exist':79B 'exploit':31B,85B 'exposur':193C 'fix':95B 'follow':165C 'forens':158C 'function':6A,109C 'give':58B 'global':3A,56B 'guidanc':154C,170C 'guidelin':202C 'host':39B 'includ':92B 'inclus':4A,107C 'instal':125C 'instruct':135C 'internet':192C 'langflow':1A,21A,22A,23A,24A,32B,40B,104C 'list':82B 'mitig':130C,181C 'name':98B 'need':75B 'note':153C,164C 'patch':201C 'path':52B 'poc':34B,78B 'poc-publ':33B 'priorit':144C 'product':179C 'public':35B,77B 'python':45B 'rate':68B 'rce':36B 'read':103B 'remot':11A,59B,117C 'requir':127C,160C 'respons':186C 'risk':149C 'root':63B 'run':41B 'secur':145C 'see':150C,161C 'self':38B 'self-host':37B 'servic':173C 'sphere':10A,113C 'stakehold':184C 'suppli':44B 'tool':30B 'triag':159C 'unavail':183C 'untrust':8A,111C 'updat':146C 'url':151C,162C 'use':176C 'user':43B 'user-suppli':42B 'valid':51B,53B 'vendor':134C 'version':88B,96B 'vulner':14A,114C 'zdi':67B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-23T04:16:04+00:00","kev":{"dateAdded":"2026-07-21","dueDate":"2026-07-24","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-0770","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0770","severity":null,"published_at":"2026-07-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-0770:23","url":null,"severity":null,"published_at":"2026-10-23T20:42:46+00:00","modified_at":"2026-10-23T20:42:46+00:00","first_seen_at":"2026-10-23T20:42:46+00:00","fetched_at":"2026-10-23T20:42:46+00:00","note":"ZDI-26-036 (0-day, unpatched at disclosure) and GHSA-g22f-v6f7-2hrh: unauthenticated RCE via exec() in Langflow validate code endpoint, affects <= 1.7.3; public PoC (affix); KEV-listed. No vendor-named fixed version found; GitHub advisory says patched: none, Cal-CSIC says upgrade to latest. 1.8.0 exists but I did not confirm it fixes this CVE."},{"source":"nvd","external_id":"CVE-2026-0770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0770","severity":null,"published_at":"2026-01-23T04:16:04+00:00","modified_at":"2026-07-22T05:17:08+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":859,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-036/","title":"ZDI-26-036 Langflow exec_globals RCE (0-day advisory)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":860,"url":"https://github.com/advisories/GHSA-g22f-v6f7-2hrh","title":"GHSA-g22f-v6f7-2hrh: Langflow validate_code() exec() RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":861,"url":"https://github.com/affix/CVE-2026-0770-PoC","title":"affix CVE-2026-0770 PoC","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":862,"url":"https://www.caloes.ca.gov/wp-content/uploads/CSIC_Cyber_Advisory-Remote-Code-Execution-Vulnerability-Identifed-in-LangFlow.pdf","title":"Cal-CSIC advisory CAL-CSIC-202607-A-012","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}