CISA Orders Federal Agencies to Patch Actively Exploited Langflow RCE Flaw (CVE-2026-0770) — Threadlinqs Intelligence
As of 2026-07-22, CISA Orders Federal Agencies to Patch Actively Exploited Langflow RCE Flaw (CVE-2026-0770) is a critical-severity vulnerability threat attributed to Unknown (mass opportunistic scanning, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-1618 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: Unknown (mass opportunistic scanning · FINANCIAL
CISA added CVE-2026-0770, an unauthenticated remote code execution vulnerability in the Langflow visual AI-agent building framework, to its Known Exploited Vulnerabilities catalog on July 21-22, 2026,
Langflow is an open-source, low-code visual builder for constructing LLM-backed "agentic" pipelines that commonly hold cloud provider credentials, third-party API keys, and database connection strings so that flows can call out to production data and internal services. CVE-2026-0770 (CVSS 3.0 9.8 CRITICAL, CWE-829: Inclusion of Functionality from Untrusted Control Sphere) is a code-validation flaw in the `validate_code()` handler backing the `POST /api/v1/validate/code` endpoint. That endpoint accepts a Python function definition plus an `exec_globals` context and runs it through the interpreter's `exec()` builtin with no sandboxing. Because the endpoint requires no authentication and the exec_globals context exposes `importlib` and Python builtins, an attacker can submit a function whose *default argument* evaluates immediately at definition time -- before any explicit "call" is made -- importing `subprocess`, `os`, or `socket` and running arbitrary shell commands. A common exploitation trick (documented in public PoCs) wraps the command output in a generator `.throw()` call so the result is returned to the attacker inside the HTTP error/exception body, giving full read/write command execution with output exfiltration over a single unauthenticated HTTP request. Affected installations run root or root-equivalent Langflow processes in many deployments (e.g., default Docker images), so successful exploitation grants an attacker code execution with server-process privileges, direct access to environment variables (API keys, DB credentials), and, in cloud-hosted deployments, the ability to reach the instance metadata service (IMDS) to steal AWS/GCP/Azure credentials and enumerate container metadata. Zero Day Initiative (ZDI-26-036) coordinated disclosure with the vendor starting July 18, 2025, with public advisory release on January 9, 2026 (CVE ID CVE-2026-0770; GitHub Security Advisory GHSA-g22f-v6f7-2hrh). Despite the January patch advisory, KEVIntel and CISA observed mass in-the-wild scanning and exploitation beginning June 27, 2026 -- more than five months after disclosure -- underscoring slow patch adoption among self-hosted Langflow operators. Observed post-exploitation activity includes system/command execution checks, broader host and network reconnaissance, deployment of second-stage malware payloads, harvesting of AWS credentials and environment variables, and retrieval of cloud container metadata, consistent with initial-access brokering and credential-theft campaigns. Langflow has a track record of exploited vulnerabilities: the JadePuffer ransomware operation is documented separately abusing a related but distinct Langflow flaw, CVE-2025-3248 (missing authentication), to dump Langflow's backing PostgreSQL database as part of ransomware operations; CISA separately added another Langflow authorization-bypass flaw, CVE-2026-55255, to KEV on July 21, 2026 in the same public-alert cycle. CISA's Binding Operational Directive 26-04 (which replaced the prior uniform two-week BOD 22-01 clock in June 2026) sets variable, risk-based remediation deadlines for FCEB agencies based on severity and evidence of active exploitation; the CVE-2026-0770 KEV entry carries a Friday remediation deadline following its July 21-22, 2026 catalog addition. CISA and researchers recommend organizations investigate historical requests to /api/v1/validate/code, review host and cloud-audit logs for anomalous credential use, restrict/firewall access to the validation endpoint, and rotate any credentials that were reachable from the Langflow host.
Weaknesses (CWE)
CWE-829, CWE-94, CWE-95
Target sectors: government administration, technology, finance, critical infrastructure
Target regions: North America, Global
Detections & IOCs
As of 2026-07-22, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-0770, T1595, T1190, T1059, T1203, T1505, T1211, T1082, T1526, T1518, T1552