# CISA Orders Federal Agencies to Patch Actively Exploited Langflow RCE Flaw (CVE-2026-0770)

> CISA added CVE-2026-0770, an unauthenticated remote code execution vulnerability in the Langflow visual AI-agent building framework, to its Known Exploited Vulnerabilities catalog on July 21-22, 2026, ordering federal agencies to patch under Binding Operational Directive 26-04. The flaw stems from unsafe evaluation of the exec_globals parameter passed to Langflow's /api/v1/validate/code endpoint, letting an unauthenticated attacker run arbitrary Python (and therefore OS-level) commands as the Langflow process user. Active exploitation has been observed since June 27, 2026, with over 220 attempts from 64 unique source IPs performing reconnaissance, second-stage malware deployment, and AWS credential/container-metadata theft.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1618
- **ID:** TL-2026-1618
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0770

## Description

Langflow is an open-source, low-code visual builder for constructing LLM-backed "agentic" pipelines that commonly hold cloud provider credentials, third-party API keys, and database connection strings so that flows can call out to production data and internal services. CVE-2026-0770 (CVSS 3.0 9.8 CRITICAL, CWE-829: Inclusion of Functionality from Untrusted Control Sphere) is a code-validation flaw in the `validate_code()` handler backing the `POST /api/v1/validate/code` endpoint. That endpoint accepts a Python function definition plus an `exec_globals` context and runs it through the interpreter's `exec()` builtin with no sandboxing. Because the endpoint requires no authentication and the exec_globals context exposes `importlib` and Python builtins, an attacker can submit a function whose *default argument* evaluates immediately at definition time -- before any explicit "call" is made -- importing `subprocess`, `os`, or `socket` and running arbitrary shell commands. A common exploitation trick (documented in public PoCs) wraps the command output in a generator `.throw()` call so the result is returned to the attacker inside the HTTP error/exception body, giving full read/write command execution with output exfiltration over a single unauthenticated HTTP request. Affected installations run root or root-equivalent Langflow processes in many deployments (e.g., default Docker images), so successful exploitation grants an attacker code execution with server-process privileges, direct access to environment variables (API keys, DB credentials), and, in cloud-hosted deployments, the ability to reach the instance metadata service (IMDS) to steal AWS/GCP/Azure credentials and enumerate container metadata. Zero Day Initiative (ZDI-26-036) coordinated disclosure with the vendor starting July 18, 2025, with public advisory release on January 9, 2026 (CVE ID CVE-2026-0770; GitHub Security Advisory GHSA-g22f-v6f7-2hrh). Despite the January patch advisory, KEVIntel and CISA observed mass in-the-wild scanning and exploitation beginning June 27, 2026 -- more than five months after disclosure -- underscoring slow patch adoption among self-hosted Langflow operators. Observed post-exploitation activity includes system/command execution checks, broader host and network reconnaissance, deployment of second-stage malware payloads, harvesting of AWS credentials and environment variables, and retrieval of cloud container metadata, consistent with initial-access brokering and credential-theft campaigns. Langflow has a track record of exploited vulnerabilities: the JadePuffer ransomware operation is documented separately abusing a related but distinct Langflow flaw, CVE-2025-3248 (missing authentication), to dump Langflow's backing PostgreSQL database as part of ransomware operations; CISA separately added another Langflow authorization-bypass flaw, CVE-2026-55255, to KEV on July 21, 2026 in the same public-alert cycle. CISA's Binding Operational Directive 26-04 (which replaced the prior uniform two-week BOD 22-01 clock in June 2026) sets variable, risk-based remediation deadlines for FCEB agencies based on severity and evidence of active exploitation; the CVE-2026-0770 KEV entry carries a Friday remediation deadline following its July 21-22, 2026 catalog addition. CISA and researchers recommend organizations investigate historical requests to /api/v1/validate/code, review host and cloud-audit logs for anomalous credential use, restrict/firewall access to the validation endpoint, and rotate any credentials that were reachable from the Langflow host.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1211 Exploitation for Stealth
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1518 Software Discovery
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [CISA orders feds to patch actively exploited Langflow RCE flaw](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-langflow-rce-flaw/)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-0770](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770)
- [NVD - CVE-2026-0770 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-0770)
- [Langflow affected by Remote Code Execution via validate_code() exec() - GHSA-g22f-v6f7-2hrh](https://github.com/advisories/GHSA-g22f-v6f7-2hrh)
- [ZDI-26-036: Langflow validate endpoint exec_globals RCE Advisory](https://www.zerodayinitiative.com/advisories/ZDI-26-036/)
- [CVE-2026-0770 Remote Code Execution Proof-of-Concept (affix)](https://github.com/affix/CVE-2026-0770-PoC)
- [CVE-2026-0770 Langflow Remote Code Execution PoC (0xgh057r3c0n)](https://github.com/0xgh057r3c0n/CVE-2026-0770)
- [CVE-2026-0770 Langflow remote code execution exploit (diamorphine666)](https://github.com/diamorphine666/CVE-2026-0770)
- [CISA Adds First AI Agent Platform to KEV, Sets Thursday Deadline for 4 CVEs](https://www.techtimes.com/articles/319918/20260708/cisa-adds-first-ai-agent-platform-kev-sets-thursday-deadline-4-cves.htm)
- [CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV (JadePuffer / CVE-2025-3248 context)](https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html)
- [BOD 26-04: Implementation Guidance for Prioritizing Security Updates Based on Risk](https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk)
- [Langflow RCE under active attack months after a patch was shipped](https://www.csoonline.com/article/4185063/langflow-rce-under-active-attack-months-after-a-patch-was-shipped.html)
- [CVE-2026-0770 - Vulnerability-Lookup (CIRCL)](https://vulnerability.circl.lu/vuln/CVE-2026-0770)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1618