Langflow's fifth KEV entry: CVE-2026-0770, patch by Friday

CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog on 2026-07-21 with a federal patch deadline of Friday, 2026-07-24. That is a three-day clock. Most of the readers of this site have longer than that on paper — but if you run Langflow on the public internet at version 1.7.3 or older, you should be treating the federal deadline as yours too, and the reason is a year-long timeline that ends with the catalog telling you exploitation is already happening.

What changed

CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow’s validate endpoint — specifically the handling of the exec_globals parameter accepted by /api/v1/validate. NVD scores it 9.8 critical. The class is the plain kind: untrusted input reaches a code-execution pathway, so anyone who can reach that endpoint can run code as the Langflow process — typically root inside the container — without ever logging in. Affected versions per NVD are 1.7.3 and older.

The honest timeline

Because this one has one, and it matters.

• 2025-07-18. Trend Micro’s Zero Day Initiative reported the flaw to Langflow via the project’s GitHub. Researchers: Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira of Trend Research.
• 2025-09-11 and 2025-10-10. ZDI asked for status. No vendor response either time.
• 2025-12-10. ZDI told Langflow it was going to publish as a zero-day.
• 2026-01-09. ZDI-26-036 went public, still with no acknowledged vendor patch of record on the advisory.
• 2026-06-27. KEVIntel logged the first in-the-wild attempts, per BleepingComputer’s reporting today; Trend Research counted 220+ attempts from 64 unique IPs across the period that followed.
• 2026-07-21. CISA added it to KEV. Federal deadline: Friday.

A year from private disclosure to KEV, six months of it as a public zero-day, and roughly four weeks of confirmed exploitation before the catalog caught up. If you are running an old Langflow build on a public IP, assume you are on somebody’s target list already — the pre-KEV exploitation window was long enough for that to be a live question, not a paranoid one.

What to actually do

Patch first, patch now. Upgrade to a current Langflow 1.9.x release. Anything at 1.7.3 or below is in-scope. Upgrading past 1.7.3 also carries you across the fix for CVE-2026-55255, the authenticated IDOR from the July 7 KEV batch — so this is one upgrade that clears two KEV entries at once. Do the whole jump; do not stop at “the version that fixes this specific CVE” and leave known-exploited neighbors in place.

If you cannot patch this week — vendor pipeline, air-gapped deploy, wrapped in a downstream distribution you do not control — take the instance off the internet. Bind it to a VPN, put it behind an ingress ACL, whatever your environment lets you do inside three days. There is no fig-leaf mitigation for an unauthenticated RCE on a validate endpoint; the ingress restriction is the mitigation, and the vendor advisory is the reason to trust that framing rather than a hunt for a WAF rule that “should catch” the payload shape.

Then check the last four weeks of your logs, because Trend Research’s write-up of the observed activity gives you concrete hunt targets. Post-exploitation attempts have included deploying malware, harvesting AWS credentials, reading environment variables, and pulling container metadata. Look for:

• Unexpected outbound calls from the Langflow container to 169.254.169.254 — the AWS instance metadata service — or to your cloud’s IMDS equivalent.
• New IAM keys created that you did not create, or the Langflow instance’s role suddenly used from an IP that is not yours.
• Unexplained processes in the Langflow container’s ancestry — anything that did not come from your image.
• Requests to /api/v1/validate with an exec_globals field present at all. You should almost never see that in normal use, and it is the field name in the CVE description; call it a keyword search rather than a signature.

The priority call

If you have one hour tonight, spend it on the upgrade for any Langflow instance that is public-facing. If you do not have that hour, spend it on getting the instance off the public internet until you do. Everything else — log hunt, credential rotation on the instance role, cleanup of anything the hunt turns up — is next-morning work, in that order.

One editorial note

This is the fifth Langflow entry on the KEV catalog in fourteen months — CVE-2025-3248 added 2025-05-05, CVE-2026-33017 added 2026-03-25, CVE-2025-34291 added 2026-05-21, CVE-2026-55255 added 2026-07-07, and now CVE-2026-0770. If you are still running Langflow the way you were a year ago — public endpoint, no ingress restriction, no version-pin discipline, no incident-hunt cadence — the catalog has been telling you for a year to change the deployment shape, not just to patch. Patch by Friday, then change the deployment shape by month-end.