Intel

CVE-2026-0770

Langflow Langflow — Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

criticalKEV: actively exploitedPoCEPSS 63%

Description

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Source: CISA_KEVNVDCVEORGCVELISTV5OSVOSV

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N) and an EPSS percentile of 99.2 %, this vulnerability sits at the extreme high end of both severity and exploitation likelihood. The critical differentiator is the combination of zero authentication required and code execution in the root context, meaning a single HTTP request can result in full system compromise. Langflow is commonly deployed in AI/ML development pipelines, research infrastructure, and increasingly in production automation platforms — environments that routinely hold high-value secrets such as cloud provider credentials and LLM API keys. For NIS2-scoped organisations, the blast radius is amplified wherever Langflow has network adjacency to critical internal systems; this should be treated as a P1 incident with a patch window of under 24 hours and immediate isolation if patching is not feasible.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Upgrade Langflow to a version above 1.7.3 as soon as a fix is released — check the vendor security advisory at https://github.com/langflow-ai/langflow/security/advisories for the exact target version. Until then, apply the compensating controls below.
  • Isolate exposed instances immediately: Take any Langflow instance reachable from the internet or untrusted network segments offline, or restrict access to an explicit allowlist. Langflow listens on TCP 7860 by default — block this port at the perimeter firewall now.
  • Block the validate endpoint: Deny all requests to /api/v1/validate (the entry point for the exec_globals parameter) at the WAF or reverse-proxy layer until the patch is deployed.
  • Hunt for active compromise: On all Langflow hosts, immediately inspect the process tree for unexpected child processes spawned by python/uvicorn (e.g. reverse shells, curl, wget, bash -i). Capture a process snapshot and compare against a known-good baseline.
  • Rotate exposed credentials: Rotate all API keys, database passwords, and cloud credentials accessible by the Langflow process (which may run as root) and store them in a secrets manager with new values.
  • Preserve forensic evidence: Capture a memory dump and access logs from the Langflow service before any patching or restarts alter the evidentiary state.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Move Langflow instances into a dedicated, tightly controlled VLAN or network segment. Restrict outbound connections from the Langflow host to known destinations only (LLM API endpoints, internal databases) via egress firewall — this breaks attacker callback channels in the event of RCE.
  • WAF rule: Block HTTP requests to /api/v1/validate containing exec_globals in the request body or query string. ModSecurity/NGINX example: location ~ /api/v1/validate { deny all; } or a WAF keyword-match rule on exec_globals.
  • Least-privilege / non-root operation: Langflow must not run as root. Reconfigure the systemd unit or container spec to use a dedicated unprivileged user (UID ≥ 1000); set NoNewPrivileges=true and clear CapabilityBoundingSet.
  • Container hardening: If running in Docker/Kubernetes, enforce a read-only filesystem, apply a seccomp profile (runtime/default), enable AppArmor or SELinux confinement, and disable privileged container modes.
  • Enforce authentication at the proxy layer: Place an nginx or Traefik reverse proxy in front of Langflow and require at minimum HTTP Basic Auth or mTLS until the patch is available — this raises the bar significantly given the vulnerability requires no authentication.

Runbook · Step 3

Detection rules

  • Web server access logs: Flag POST /api/v1/validate requests with a body size > 500 bytes or containing the string exec_globals — SPL: index=weblogs uri_path="*/validate" method=POST | where len(request_body)>500 OR like(request_body,"%exec_globals%")
  • Process ancestry (EDR / Sysmon EID 1): Alert on shell interpreters or network utilities (bash, sh, curl, wget, nc, ncat) spawned as children of python or uvicorn — Sigma shape: ParentImage|endswith: 'python*' AND Image|endswith: ('bash','sh','curl','wget','nc')
  • Linux auditd: Monitor execve syscalls where the parent PID belongs to the Langflow process and arguments contain suspicious patterns (Base64 strings, /tmp/ paths): auditctl -a always,exit -F arch=b64 -S execve -F ppid=<langflow_pid>
  • Network telemetry (Zeek / Suricata): Correlate POST /validate HTTP log entries with outbound TCP connections from the Langflow host to unknown external IPs on high ports (> 1024) within a short time window using conn.log timestamps.
  • Sysmon EID 3 (network connection): Alert on python or python3 initiating outbound connections to external IPs on ports other than 80/443 — KQL: event.code:3 AND process.name:python* AND NOT destination.port:(80 OR 443)

Metrics

Severity
critical
Priority score
235.86
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
—
EPSS percentile
99.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
63.4 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-07-21 00:00 UTC
CWE
CWE-829

Weakness classes (CWE)

  • CWE-829Base

    Inclusion of Functionality from Untrusted Control Sphere

    The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-07-22 05:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-0770","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technica… → {"id":"CVE-2026-0770","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technica…
  2. Modified Analysis2026-07-21 19:22 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:* → OR *cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* versions up to (including) 1.7.3
    • Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770 Types: US Government Resource
  3. CVE Modified2026-07-21 16:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770
    • SSVC: {"id":"CVE-2026-0770","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalI… → {"id":"CVE-2026-0770","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technica…
  4. CVE CISA KEV Update2026-07-21 16:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-07-21
    • Due Date: 2026-07-21
    • Required Action: 2026-07-21
    • Vulnerability Name: 2026-07-21

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • langflow

    langflow1.7.3

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2026-0770