CVE-2026-0770
Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Description
CVE-2026-0770 is an inclusion of functionality from untrusted control sphere vulnerability in Langflow that allows remote attackers to execute arbitrary code on affected installations without any authentication. The flaw sits in the handling of the exec_globals parameter supplied to the validate endpoint: the parameter causes a resource from an untrusted control sphere to be included, and the resulting code runs in the context of root. Langflow versions up to and including 1.7.3 are affected, so any exposed instance of this low-code AI workflow builder can be taken over with a single request. Rated CVSS 9.8 (Critical) with an EPSS score of 56%, which places it in the 99th percentile for exploitation likelihood, CVE-2026-0770 was added by CISA to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-24. Because Langflow instances are frequently deployed in containers running as root and often hold API keys for model providers and connected data sources, a successful exploit yields both host control and credential theft.
KEV Information
CVSS Score
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| langflow | langflow | <= 1.7.3 |
References
- https://www.zerodayinitiative.com/advisories/ZDI-26-036/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770(US Government Resource)
Weakness Type
CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of Functionality from Untrusted Control Sphere occurs when a product imports, requires, or includes executable functionality — a library, plugin, script, or module — from a source outside its intended control sphere, which lets an attacker inject code that executes inside the vulnerable application. In Langflow the exec_globals parameter of the validate endpoint accepts attacker-influenced content that becomes part of the executed environment, so the boundary between data submitted for validation and code trusted for execution disappears and the attacker's functionality runs with the process's root privileges.
Learn more: CWE-829 — Inclusion of Functionality from Untrusted Control Sphere
Impact Analysis
CVE-2026-0770 carries a CVSS 3.0 base score of 9.8 (Critical) with every exploitability metric at its worst: remotely exploitable without physical access, easy to exploit with no special conditions needed, no authentication needed, and no user action required. Confidentiality (High): code execution as root exposes everything on the host, and in a Langflow deployment that typically means provider API keys, database connection strings, and the contents of the flows that describe an organisation's AI pipelines. Integrity (High): the attacker can modify flows, inject persistence, and alter any file the root user can write, which includes tampering with the application itself. Availability (High): the same privileges allow the service or the host to be disabled outright. The EPSS score of 56% (98.95th percentile) indicates a high likelihood of active exploitation, matching the CISA KEV listing. What makes the practical risk severe is the deployment pattern: Langflow is often stood up quickly for experimentation, exposed to a network without an authentication layer in front, and left running as root inside a container that has credentials for production model APIs and data stores.
Exploit Maturity
CVE-2026-0770 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild, with a remediation deadline of 2026-07-24; ransomware use is currently marked as Unknown. The vulnerability was reported through the Zero Day Initiative and published as ZDI-26-036 alongside the CISA KEV entry; no public exploit code is linked in the available references, though a ZDI advisory documents the affected endpoint and parameter clearly enough that reproduction is straightforward for a capable attacker. The EPSS score of 56.3% (98.95th percentile) indicates a high probability of continued exploitation activity, which is consistent with an unauthenticated single-request path to root code execution in software that is commonly exposed without a front-end authentication layer. Anyone running Langflow 1.7.3 or earlier on a reachable network should treat this as an active incident: upgrade, then rotate the credentials the instance held.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-24.
- Upgrade Langflow to a release newer than 1.7.3, since all versions up to and including 1.7.3 are affected. The vulnerability is documented in ZDI-26-036, originally tracked as ZDI-CAN-27325; confirm the installed version after upgrading, because container images pinned to a tag may not have moved.
- Remove Langflow from untrusted network exposure immediately and place it behind an authenticating reverse proxy or VPN, since the
validateendpoint requires no credentials. Blocking external access to the endpoint is the fastest effective mitigation where an upgrade cannot be completed at once. - Stop running Langflow as root: run the container or service under an unprivileged user, drop unnecessary Linux capabilities, and mount the filesystem read-only where possible, so that the same flaw no longer yields root-level code execution.
- Assume compromise on any instance that was network-reachable, since exploitation is confirmed in the wild: rotate every credential the instance held, including model provider API keys, database passwords, and cloud tokens, review process and network logs for outbound connections initiated by the Langflow process, and inspect flows and the filesystem for injected code. As long-term hardening against CWE-829, only include functionality from trusted, verified sources, enforce allowlists for permitted modules, and never let request-supplied data reach an execution context.
Technical Details
The specific flaw of CVE-2026-0770 exists in Langflow's handling of the exec_globals parameter provided to the validate endpoint: the value influences which resource is included into the execution environment, and because that resource comes from an untrusted control sphere, the attacker's code is executed rather than merely inspected (CWE-829). Weaknesses of this class arise wherever an application resolves executable functionality using input it does not control — remote file inclusion and untrusted module loading are the classic forms — and the result is code running with the full privileges of the host process, here root. The vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H shows why the score reaches 9.8: the request arrives over the network (AV:N) with no special conditions (AC:L), no privileges (PR:N), and no user interaction (UI:N), and confidentiality, integrity, and availability are all impacted at High. Scope remains unchanged (S:U) in CVSS terms because the vulnerable component and the impacted component are the same process, but since that process runs as root, the practical boundary reached is the entire container or host rather than the application alone. All Langflow versions up to and including 1.7.3 contain the vulnerable endpoint handling.
Frequently Asked Questions
Is CVE-2026-0770 being actively exploited?
Yes. CVE-2026-0770 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-07-24, and its EPSS score of 56.3% places it in the 99th percentile for exploitation likelihood. Ransomware usage is currently marked as Unknown, but an unauthenticated path to root-level code execution is attractive to a broad range of attackers.
What products are affected by CVE-2026-0770?
The vulnerability affects Langflow in all versions up to and including 1.7.3. The vulnerable code path is the handling of the exec_globals parameter on the validate endpoint, which requires no authentication, so any Langflow instance reachable over the network is exposed regardless of how it is otherwise configured.
How do I fix CVE-2026-0770?
Upgrade Langflow to a version newer than 1.7.3 as described in ZDI-26-036, and until then block network access to the instance or place it behind an authenticating reverse proxy. Because exploitation yields code execution as root, also stop running Langflow as a privileged user and rotate every API key and database credential the instance had access to.
How severe is CVE-2026-0770?
CVE-2026-0770 is rated Critical with a CVSS 3.0 base score of 9.8, reflecting unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Its EPSS score of 56.3% sits in the 99th percentile, and the fact that the executed code runs as root means a single successful request compromises the whole host, not just the Langflow application.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.