Langflow code-execution flaw CVE-2026-0770 exploited; fixed version remains unconfirmed
Attackers are exploiting CVE-2026-0770 to run code on Langflow AI-building servers without logging in. Restrict access and check for compromise. CISA links version 1.9.0, but a vendor-confirmed fix could not be verified.
If your business or family office runs Langflow, ask its administrator to restrict access to trusted users behind external authentication and confirm remediation with Langflow. Have them review historical validation requests and server activity, and replace potentially exposed credentials if compromise cannot be ruled out. Families who do not run Langflow have no direct device update to install.
What’s happening
CVE-2026-0770 affects Langflow, software used to build AI agents and workflows. Its code-validation feature can accept untrusted functionality, allowing a remote attacker to run code without logging in; ZDI says this can run as root. Public disclosure came on 9 January, exploitation attempts were first observed on 27 June, and CISA confirmed exploitation on 21 July. Reported payloads attempted malware installation and access to cloud credentials. Previdian's later sensor report lists attempts through 30 September. As of 3 November, the exact vendor-confirmed affected range and fixed release remain unclear. GitHub lists versions through 1.7.3 and no patch, while CISA's entry links Langflow 1.9.0. That release's notes do not explicitly identify a fix for this CVE, so it cannot safely be marked patched. Langflow's own security guidance requires external authentication and infrastructure isolation. The number of compromised organisations and any ransomware use remain unknown.
- What
- Flaw
- Affects
- Langflow AI agent and workflow builder
- Affected
- Langflow — vendor-confirmed affected-version range not established
- Fixed in
- No fix yet
- Since
- 21 July 2026
Timeline
- Update
Previdian's updated sensor report listed 30 September as its latest observed exploitation attempt. These observations do not establish how many real installations were compromised.
- Wider attacks
BleepingComputer reported more than 220 attempts from 64 source IP addresses before CISA's listing. KEVIntel said payloads included attempts to install malware and obtain AWS credentials, environment variables and container metadata.
- CISA added
CISA added the flaw to its known exploited catalogue, with a 24 July remediation deadline for federal agencies. Its entry links Langflow 1.9.0; ransomware use is recorded as unknown.
- Wider attacks
KEVIntel first observed exploitation attempts, according to its subsequent account to BleepingComputer.
- Update
GitHub updated its reviewed advisory to list Langflow versions through 1.7.3 as affected, with no patched version listed. This is GitHub's assessment, rather than a vendor-confirmed version range.
- Made publicNo fix yet
ZDI publicly disclosed CVE-2026-0770 after reporting it to Langflow on 18 July 2025. It described code execution without a login and advised restricting access to the product.
Sources
- Security | Langflow DocumentationLangflow
- Langflow 1.9.0 release notesLangflow · 14 Apr 2026
- ZDI-26-036: Langflow exec_globals remote code execution vulnerabilityTrend Micro Zero Day Initiative · 9 Jan 2026
- Langflow affected by Remote Code Execution via validate_code() exec()GitHub · 19 Feb 2026
- CISA KEV entry: CVE-2026-0770, reproduced by CIRCLCIRCL · 21 July 2026
- CISA orders urgent action on actively exploited Langflow RCE flawBleepingComputer · 22 July 2026
- CVE-2026-0770 Exploitation Observed — LangflowPrevidian · 23 Oct 2026