Langflow validate-endpoint exec_globals RCE (unauthenticated)

CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, the open-source visual builder for LLM workflows. The flaw lives in the handling of the exec_globals parameter accepted by the validate endpoint (/api/v1/validate); untrusted input reaches a code-execution pathway (CWE-829, inclusion of functionality from an untrusted control sphere), letting a remote attacker with network access to the endpoint execute arbitrary code in the context of the Langflow process — typically root inside the container. No authentication is required.

Affected

Per NVD, Langflow versions 1.7.3 and older are in scope. Upgrade to a current Langflow 1.9.x release.

Exploitation status

Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-21 with a federal patch deadline of 2026-07-24 under BOD 22-01 / BOD 26-04. Trend Research reports observed exploitation attempts starting 2026-06-27, with post-exploitation activity including attempts to steal AWS credentials, dump container metadata, and pull environment variables.

Disclosure timeline

Discovered by Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira of Trend Research and reported to Langflow’s GitHub via ZDI-26-036 on 2025-07-18. After no vendor response through follow-ups in September and October 2025, ZDI notified the vendor in December 2025 of intent to publish as a zero-day; the advisory went public on 2026-01-09.

Reference

• CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-0770
• ZDI advisory: https://www.zerodayinitiative.com/advisories/ZDI-26-036/