Langflow: CISA Orders 72-Hour Patch for Pre-Auth RCE as Root

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog on July 21, 2026, with a remediation deadline of July 24, 2026 for U.S. federal civilian executive branch (FCEB) agencies. The vulnerability allows unauthenticated remote arbitrary code execution as a root process in Langflow. In-the-wild exploitation has been documented since June 27, 2026, with payloads that go beyond simple system reconnaissance.

The Technical Mechanism: exec_globals Without Boundaries

The flaw lies in how Langflow handles the exec_globals parameter of the /api/v1/validate/code endpoint. According to advisory ZDI-26-036, this endpoint "accepts and executes arbitrary Python code without authentication." The CWE-829 classification — Inclusion of Functionality from Untrusted Control Sphere — indicates the system incorporates resources from an untrusted control sphere without sufficient validation.

The NVD CVE-2026-0770 record confirms the attack vector and impact: code execution in the context of root. The CVSS 3.0 score of 9.8, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects network access, low complexity, no privileges required, no user interaction, and total impact on confidentiality, integrity, and availability.

The combination of remote access, no authentication, and maximum privileges turns every exposed instance into a potential entry point for complete compromise of the underlying host.

"The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. An attacker can leverage this vulnerability to execute code in the context of root." — Zero Day Initiative, advisory ZDI-26-036

A Six-Month Timeline Without Immediate Patch

The vulnerability was reported to Langflow on July 18, 2025, per the structured timeline in advisory ZDI-26-036. The public advisory was released on January 9, 2026. Nearly twelve months elapsed between reporting and inclusion in the CISA KEV catalog; roughly six months passed between the advisory publication and documented exploitation.

This time window is particularly relevant for a platform with over 150,000 GitHub stars and enterprise adoption — Langflow passed through acquisitions by DataStax and subsequently IBM, positioning itself as a central tool for AI workflows in corporate environments.

The absence of an immediate patch is not an exception in the AI-infrastructure vulnerability landscape, but the severity of this flaw — pre-auth, RCE, root — places it in a risk category where timing itself becomes an actor in the compromise.

The Ongoing Attack: Beyond Reconnaissance

Kevin Beaumont of KEVIntel detected active exploitation starting June 27, 2026. Collected data shows over 220 attempts from 64 unique IP addresses. These numbers, reported by BleepingComputer with attribution to KEVIntel, indicate a distributed campaign rather than isolated scans.

Ryan Dewhurst, founder of KEVIntel, clarified that "most activity involved command-execution checks or system reconnaissance. However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files." This escalation from reconnaissance to AWS credential theft and container metadata retrieval marks an operational pattern aimed at persistent compromise of adjacent cloud infrastructure.

The dossier does not identify specific threat actors behind these attempts. The shift from command-execution verification to second-stage script downloads suggests more structured operations compared to a simple automated probe.

Immediate Actions

Ryan Dewhurst, via KEVIntel through BleepingComputer, indicated concrete actions for organizations running Langflow:

• Investigate historical requests to the /api/v1/validate/code endpoint to identify suspicious access or unauthorized executions
• Review host activity on systems running Langflow, focusing on anomalous processes started during the exposure period
• Restrict access to the code validation functionality, limiting the exposed surface where technically feasible
• Rotate exposed credentials where successful execution cannot be ruled out, particularly cloud credentials and environment variables

The NVD CVE-2026-0770 record indicates affected versions up to and including 1.7.3. Official Langflow release notes are not cited in the dossier as a primary source for the specific patch; upgrading to versions later than 1.7.3 is the deducible course of action from the published CPE.

Why CISA Pressure Changes the Equation

Inclusion in the KEV catalog with a BOD 26-04 deadline of July 24, 2026 imposes a 72-hour remediation cadence on U.S. federal agencies. This timeline, applied to a pre-auth vulnerability on an AI platform, transforms CVE-2026-0770 from a technical advisory into a cyber governance event with cascading effects on supply chains.

The triple pressure described in the brief — protracted disclosure, active exploitation, security priority not matching adoption — finds its convergence point here. Private organizations using Langflow, even if not bound by BOD 26-04, now operate in a context where CISA has deemed the risk uncontainable without immediate intervention.

The ~7,000 exposed instances detected by VulnCheck for CVE-2026-5027 — a distinct path traversal vulnerability in Langflow — does not directly apply to CVE-2026-0770, but provides an order-of-magnitude estimate of the platform's attack surface. The actual number of installations vulnerable to the pre-auth RCE is not quantified in the dossier.

The Open Question on AI Platform Security

Langflow is not a marginal tool. Its position as an AI workflow orchestrator often places it adjacent to sensitive data, model APIs, and cloud infrastructure. The combination of open-source popularity, enterprise acquisitions, and this specific flaw — arbitrary code execution as root with a single POST — raises a broader question about the security maturity of platforms mediating production AI adoption.

The dossier does not document confirmed compromises beyond the observed attempts. It does not identify specific patches beyond the indication of versions >1.7.3. It does not attribute offensive activity to known groups. These limits, however, do not attenuate the gravity of the signal: a mass-adoption AI platform, pre-auth RCE as root, documented exploitation, and government intervention in 72 hours.

The coming week will tell whether the response matches the speed at which the risk has materialized.

Sources

• https://www.tomshw.it/hardware/langflow-falla-rce-sfruttata-codice-eseguibile-come-root-senza-autenticazione
• https://labs.cloudsecurityalliance.org/research/csa-research-note-langflow-cve-2026-5027-active-exploitation/
• https://www.securityweek.com/hackers-exploit-langflow-vulnerability-for-remote-code-execution/
• https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/
• https://www.zerodayinitiative.com/advisories/ZDI-26-036/
• https://nvd.nist.gov/vuln/detail/CVE-2026-0770
• https://nvd.nist.gov/vuln/detail/CVE-2026-21445
• https://nvd.nist.gov/vuln/detail/cve-2026-5027
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770