Langflow RCE exploited in the wild (CVE-2026-0770) [PoC]

Actively exploited in the wild - CVE-2026-0770 is a critical remote code execution vulnerability in Langflow that grants unauthenticated attackers root-level access on the server. No vendor patch is currently available.

Overview

CVE-2026-0770, reported as ZDI-CAN-27325, is a critical severity vulnerability (CVSS 9.8) in Langflow, an open-source visual framework for building multi-agent AI applications. The flaw resides in the validate endpoint where the exec_globals parameter is handled. The vulnerability stems from the inclusion of resource functionality from an untrusted control sphere, effectively allowing an attacker to inject arbitrary Python code that executes in the context of the Langflow process, which runs as root.

This is a pre-authentication vulnerability - no credentials or user interaction are required to exploit it. The attack vector is over the network (AV:N) with low complexity (AC:L), making it highly accessible to opportunistic attackers.

Impact

A successful exploit allows an attacker to execute arbitrary commands with root privileges on the affected Langflow server. This gives complete control of the host system, including the ability to:

• Steal or modify all application data.
• Establish persistent backdoor access.
• Pivot to internal network resources.
• Deploy ransomware or cryptocurrency miners.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The Exploit Prediction Scoring System (EPSS) estimates a 10.4% probability of exploitation within 30 days, indicating elevated threat activity.

Remediation and Mitigation

As of this writing, the vendor has not released a patched version for Langflow. Security teams should take the following steps immediately:

1. Network Segmentation: If the vulnerable Langflow instance cannot be taken offline, restrict network access to only trusted internal IP addresses via firewall or WAF rules. Do not expose the validate endpoint to the internet.
2. Monitor for Exploitation: Inspect logs for anomalous requests to the /validate endpoint, particularly requests containing unusual exec_globals parameters.
3. Apply Virtual Patching: If using a web application firewall (WAF), deploy a virtual patch rule to block requests targeting the exec_globals parameter.
4. Consider Isolation: Run the Langflow process in a limited-user context or container rather than as root, though this may not fully prevent exploitation of the host.

Monitor threat intelligence feeds for updates. For the latest data on data breaches, visit our breach reports, and for continuous cybersecurity news updates, check security news.

Security Insight

This vulnerability highlights a recurring pattern in modern low-code and AI development platforms: the tension between convenience and security. Langflow’s design, which allows arbitrary Python execution in a visual pipeline, is architecturally precarious when exposed to the network. This is reminiscent of how early business intelligence tools (e.g., Tableau, Pentaho) suffered from similar deserialization and expression-language injection flaws. For Langflow, and the broader category of “agent-building” frameworks, default-deny network access and sandboxed execution environments must become standard practice, not afterthoughts. Leaving validation endpoints open without authentication is a fundamental design failure that attackers will continue to exploit.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs