Search CVEs, research… / diras.sa
  • CISA KEV
  • EXPLOITED
  • PoC PUBLIC

CVE-2026-0770: pre-auth remote code execution in Langflow Langflow

Remote attackers can execute arbitrary code on Langflow installations by sending crafted input to the validate endpoint; this is tracked as CVE-2026-0770. The vulnerability affects the 1.x branch (reported in 1.4.2) and does not require authentication to exploit. An attacker only needs network access to the vulnerable validate endpoint and can leverage the exec_globals handling flaw to run code on the host.

Published Updated Source: CVE Program, NVD, CISA KEV, FIRST EPSS

CVSS 3.0
9.8CRITICAL
EPSS
0.63839
CWE
CWE-829
KEV DUE DATE
PATCH
Not yet

DIRAS TAKE

Urgent — CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog with a mitigation due date of 2026-07-24, and the flaw can be triggered without authentication and has public exploit code available.

What is CVE-2026-0770?

Remote attackers can execute arbitrary code on Langflow installations by sending crafted input to the validate endpoint; this is tracked as CVE-2026-0770. The vulnerability affects the 1.x branch (reported in 1.4.2) and does not require authentication to exploit. An attacker only needs network access to the vulnerable validate endpoint and can leverage the exec_globals handling flaw to run code on the host.

Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Langflow Langflow are affected?

BRANCHAFFECTEDFIXED
1.x1.4.2

Is CVE-2026-0770 being exploited?

CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog on 2026-07-21; U.S. federal agencies were required to mitigate it by 2026-07-24. Public exploit code is available.

How to fix CVE-2026-0770

  1. Restrict network exposure: block or firewall access to Langflow instances and the validate endpoint from untrusted networks.
  2. Apply vendor mitigations per Langflow guidance if provided and follow CISA's remediation instructions.
  3. Monitor and audit logs for suspicious validate endpoint requests and indicators of code execution.
  4. If cloud-hosted, follow BOD 26-04 guidance for cloud services or consider discontinuing use until mitigations are available.

Frequently asked questions

Is CVE-2026-0770 being actively exploited?

CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog on 2026-07-21 and federal agencies were required to mitigate it by 2026-07-24; public exploit code is also available.

Which Langflow versions are affected by CVE-2026-0770?

Langflow versions in the 1.x branch are affected, with the issue reported in 1.4.2.

Is there a patch for CVE-2026-0770?

No patch is available as of 2026-09-29 and the affected entry for 1.4.2 does not list a fixed version.

Does CVE-2026-0770 require authentication?

No — exploiting the vulnerability does not require authentication against Langflow.

References