CISA Orders Federal Agencies to Patch Actively Exploited Langflow RCE Flaw (CVE-2026-0770)
CISA Orders Federal Agencies to Patch Actively Exploited (TL-2026-1618) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-22. It has no confirmed attribution, affects Langflow Langflow, references 1 CVE (CVE-2026-0770), maps to 15 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1618
- Threat ID
- TL-2026-1618
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, technology, finance, critical infrastructure
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in CISA Orders Federal Agencies to Patch Actively Exploited
Malware and tooling: unspecified second-stage payload, CVE-2026-0770 (0xgh057r3c0n), CVE-2026-0770 (diamorphine666), CVE-2026-0770-PoC (affix)
CISA added CVE-2026-0770, an unauthenticated remote code execution vulnerability in the Langflow visual AI-agent building framework, to its Known Exploited Vulnerabilities catalog on July 21-22, 2026, ordering federal agencies to patch under Binding Operational Directive 26-04. The flaw stems from unsafe evaluation of the exec_globals parameter passed to Langflow's /api/v1/validate/code endpoint, letting an unauthenticated attacker run arbitrary Python (and therefore OS-level) commands as the Langflow process user. Active exploitation has been observed since June 27, 2026, with over 220 attempts from 64 unique source IPs performing reconnaissance, second-stage malware deployment, and AWS credential/container-metadata theft.
How CISA Orders Federal Agencies to Patch Actively Exploited works
Langflow is an open-source, low-code visual builder for constructing LLM-backed "agentic" pipelines that commonly hold cloud provider credentials, third-party API keys, and database connection strings so that flows can call out to production data and internal services. CVE-2026-0770 (CVSS 3.0 9.8 CRITICAL, CWE-829: Inclusion of Functionality from Untrusted Control Sphere) is a code-validation flaw in the `validate_code()` handler backing the `POST /api/v1/validate/code` endpoint. That endpoint accepts a Python function definition plus an `exec_globals` context and runs it through the interpreter's `exec()` builtin with no sandboxing. Because the endpoint requires no authentication and the exec_globals context exposes `importlib` and Python builtins, an attacker can submit a function whose *default argument* evaluates immediately at definition time -- before any explicit "call" is made -- importing `subprocess`, `os`, or `socket` and running arbitrary shell commands. A common exploitation trick (documented in public PoCs) wraps the command output in a generator `.throw()` call so the result is returned to the attacker inside the HTTP error/exception body, giving full read/write command execution with output exfiltration over a single unauthenticated HTTP request. Affected installations run root or root-equivalent Langflow processes in many deployments (e.g., default Docker images), so successful exploitation grants an attacker code execution with server-process privileges, direct access to environment variables (API keys, DB credentials), and, in cloud-hosted deployments, the ability to reach the instance metadata service (IMDS) to steal AWS/GCP/Azure credentials and enumerate container metadata. Zero Day Initiative (ZDI-26-036) coordinated disclosure with the vendor starting July 18, 2025, with public advisory release on January 9, 2026 (CVE ID CVE-2026-0770; GitHub Security Advisory GHSA-g22f-v6f7-2hrh). Despite the January patch advisory, KEVIntel and CISA observed mass in-the-wild scanning and exploitation beginning June 27, 2026 -- more than five months after disclosure -- underscoring slow patch adoption among self-hosted Langflow operators. Observed post-exploitation activity includes system/command execution checks, broader host and network reconnaissance, deployment of second-stage malware payloads, harvesting of AWS credentials and environment variables, and retrieval of cloud container metadata, consistent with initial-access brokering and credential-theft campaigns. Langflow has a track record of exploited vulnerabilities: the JadePuffer ransomware operation is documented separately abusing a related but distinct Langflow flaw, CVE-2025-3248 (missing authentication), to dump Langflow's backing PostgreSQL database as part of ransomware operations; CISA separately added another Langflow authorization-bypass flaw, CVE-2026-55255, to KEV on July 21, 2026 in the same public-alert cycle. CISA's Binding Operational Directive 26-04 (which replaced the prior uniform two-week BOD 22-01 clock in June 2026) sets variable, risk-based remediation deadlines for FCEB agencies based on severity and evidence of active exploitation; the CVE-2026-0770 KEV entry carries a Friday remediation deadline following its July 21-22, 2026 catalog addition. CISA and researchers recommend organizations investigate historical requests to /api/v1/validate/code, review host and cloud-audit logs for anomalous credential use, restrict/firewall access to the validation endpoint, and rotate any credentials that were reachable from the Langflow host.
MITRE ATT&CK techniques used in TL-2026-1618
Collection
T1005 Data from Local System; T1530 Data from Cloud Storage
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Discovery
T1082 System Information Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Defense Evasion
T1211 Exploitation for Stealth
Impact
T1486 Data Encrypted for Impact
Persistence
T1505 Server Software Component
Credential Access
Reconnaissance
Affected products and versions in CISA Orders Federal Agencies to Patch Actively Exploited
- Langflow — Langflow
Vulnerable versions: <= 1.7.3
Fixed in: version per vendor advisory GHSA-g22f-v6f7-2hrh; verify against current release
Remediation for CISA Orders Federal Agencies to Patch Actively Exploited
Patches
- Upgrade Langflow to the latest release that remediates CVE-2026-0770 per vendor advisory GHSA-g22f-v6f7-2hrh; confirm fixed-version number against the current vendor release notes as advisory text did not enumerate an explicit fixed version at time of analysis
Immediate actions
- Restrict or firewall network access to /api/v1/validate/code to trusted management networks only
- Investigate historical/access logs for requests to /api/v1/validate/code, especially payloads containing exec_globals or default-argument function definitions
- Rotate AWS/cloud credentials, API keys, and environment-variable secrets reachable from any Langflow host where exploitation cannot be ruled out
- Block or rate-limit the instance metadata service (IMDSv1) from application containers running Langflow to reduce cloud-credential-theft blast radius
- Disable AUTO_LOGIN and change any default Langflow credentials
Workarounds
- If upgrading is not immediately possible, place Langflow behind an authenticating reverse proxy and deny external access to /api/v1/validate/code
- Run Langflow as a non-root user in a network-isolated container with no IMDS route and no cloud credentials mounted
Longer-term hardening
- Deploy EDR/host-based monitoring with behavioral detection for anomalous child-process spawning from Langflow service accounts
- Enforce network segmentation so AI/agent-builder platforms cannot reach production databases, cloud metadata endpoints, or sensitive internal APIs by default
- Adopt sandboxed/least-privilege execution for any platform feature that runs user-supplied code (e.g., gVisor, nsjail, or a non-root, network-isolated execution container)
- Maintain an inventory of self-hosted AI-agent/LLM-orchestration platforms and subscribe to their security-advisory feeds
CVEs associated with CISA Orders Federal Agencies to Patch Actively Exploited
CVE-2026-0770
Weaknesses (CWE) in CISA Orders Federal Agencies to Patch Actively Exploited
CWE-829, CWE-94, CWE-95
Timeline of CISA Orders Federal Agencies to Patch Actively Exploited
- Vulnerability initially reported to the Langflow vendor via Zero Day Initiative coordinated disclosure (ZDI-26-036).
- ZDI announces intent to publicly disclose the unpatched Langflow exec_globals RCE.
- Zero Day Initiative publishes advisory ZDI-26-036 for CVE-2026-0770.
- GitHub Security Advisory GHSA-g22f-v6f7-2hrh and NVD entry for CVE-2026-0770 published, documenting the validate_code() exec() flaw.
- First observed in-the-wild exploitation attempts against CVE-2026-0770 detected by KEVIntel sensors.
- CISA adds a separate, related Langflow authorization-bypass flaw (CVE-2026-55255) to the KEV catalog in the same news cycle, alongside Adobe and Joomla CVEs, highlighting sustained attacker interest in the Langflow platform.
- CISA adds CVE-2026-0770 to the Known Exploited Vulnerabilities catalog based on confirmed active exploitation.
- BleepingComputer reports on the KEV addition, disclosing that over 220 exploitation attempts from 64 unique IPs have targeted the flaw since June 27, including malware deployment and AWS credential/container metadata theft; CISA orders federal patching under BOD 26-04 with a Friday deadline.
Sources cited for CISA Orders Federal Agencies to Patch Actively Exploited
- CISA orders feds to patch actively exploited Langflow RCE flaw
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-0770
- NVD - CVE-2026-0770 Detail
- Langflow affected by Remote Code Execution via validate_code() exec() - GHSA-g22f-v6f7-2hrh
- ZDI-26-036: Langflow validate endpoint exec_globals RCE Advisory
- CVE-2026-0770 Remote Code Execution Proof-of-Concept (affix)
- CVE-2026-0770 Langflow Remote Code Execution PoC (0xgh057r3c0n)
- CVE-2026-0770 Langflow remote code execution exploit (diamorphine666)
- CISA Adds First AI Agent Platform to KEV, Sets Thursday Deadline for 4 CVEs
- CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV (JadePuffer / CVE-2025-3248 context)
- BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk
- Langflow RCE under active attack months after a patch was shipped
- CVE-2026-0770 - Vulnerability-Lookup (CIRCL)
Threats related to CISA Orders Federal Agencies to Patch Actively Exploited
- Langflow CVE-2026-33017 Unauthenticated RCE Actively Exploited for Monero Mining (lambsys)
- JADEPUFFER Agentic Ransomware Exploits Langflow CVE-2025-3248 and Nacos CVE-2021-29441 via Base64-Encoded Python Payloads
- CISA KEV (2026-05-21): CVE-2025-34291 Langflow CORS Token Hijack-to-RCE & CVE-2026-34926 Trend Micro Apex One On-Premise Directory Traversal
- JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) to Automate Database Ransomware/Extortion Attack
- CVE-2026-9198 — Unauthenticated RCE in IBM Langflow Under Active Exploitation (Auto-Login Bypass + Code Injection Chain)
- JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database Extortion
Detection coverage for TL-2026-1618
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1618 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.