Langflow validate-endpoint exec_globals RCE (unauthenticated)
Unauthenticated RCE in Langflow's /api/v1/validate endpoint via the exec_globals parameter. CISA added to KEV on 2026-07-21 with a federal patch deadline of 2026-07-24.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 9.8
- EPSS (exploit probability)
- 62.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-0770 being exploited?
Yes. CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 62.6% (scored October 19, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-0770 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, the open-source visual builder for LLM workflows. The flaw lives in the handling of the exec_globals parameter accepted by the validate endpoint (/api/v1/validate); untrusted input reaches a code-execution pathway (CWE-829, inclusion of functionality from an untrusted control sphere), letting a remote attacker with network access to the endpoint execute arbitrary code in the context of the Langflow process — typically root inside the container. No authentication is required.
Affected
Per NVD, Langflow versions 1.7.3 and older are in scope. Upgrade to a current Langflow 1.9.x release.
Exploitation status
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-21 with a federal patch deadline of 2026-07-24 under BOD 22-01 / BOD 26-04. Trend Research reports observed exploitation attempts starting 2026-06-27, with post-exploitation activity including attempts to steal AWS credentials, dump container metadata, and pull environment variables.
Disclosure timeline
Discovered by Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira of Trend Research and reported to Langflow’s GitHub via ZDI-26-036 on 2025-07-18. After no vendor response through follow-ups in September and October 2025, ZDI notified the vendor in December 2025 of intent to publish as a zero-day; the advisory went public on 2026-01-09.
Reference
Other Langflow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93674 Langflow Authenticated Blind Command Injectionwrite-up | [ CRITICAL ] | 9.8 | 15.3% | — |
| CVE-2026-7873 Langflow Authenticated RCE via Code Validation Endpointwrite-up | [ CRITICAL ] | 9.9 | 6.9% | — |
| CVE-2026-10134 Langflow Unauthenticated RCE in Public Flow Build Endpointwrite-up | [ CRITICAL ] | 10.0 | 2.3% | — |
| CVE-2026-0769 Langflow Unauthenticated RCE via Custom Component Evaluationwrite-up | [ CRITICAL ] | 9.8 | 41.2% | — |
| CVE-2026-105740 Authenticated RCE via MCP tool additionwrite-up | [ CRITICAL ] | 9.9 | 3.9% | — |
| CVE-2026-0768 Langflow Unauthenticated RCE via Code Execution Endpointwrite-up | [ CRITICAL ] | 9.8 | 28.1% | — |
| CVE-2026-55255 Langflow /api/v1/responses IDOR — cross-user flow executionwrite-up | [ HIGH ] | 8.4 | 0.9% | |
| CVE-2025-34291 Langflow CORS misconfiguration enables CSRF-driven token theft and RCEwrite-up | [ HIGH ] | 8.8 | 93.2% |
