On 21 July 2026 CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog, with a three day federal deadline. It is a remote code execution flaw in Langflow, the tool for building AI agents and workflows, and no login is needed.
What's affected
Langflow installations where the validate endpoint is reachable. NVD lists versions up to and including 1.7.3 as affected, scores it 9.8, and classes it as CWE-829, inclusion of functionality from an untrusted control sphere. The flaw is in how the exec_globals parameter of the validate endpoint is handled, and code runs in the context of root.
The Zero Day Initiative advisory (ZDI-26-036) is the original report. Its timeline: reported to the vendor on 18 July 2025, follow-ups in September, October and December 2025, public release on 9 January 2026. The advisory records no vendor response and names no fixed version. Its only mitigation is to restrict interaction with the product. I could not confirm a fixed release from the sources I fetched, so check your version against the Langflow release notes before you rely on an upgrade.
This is a different issue from CVE-2026-55255, the /api/v1/responses authorization flaw that CISA listed on 7 July.
What to do now
- Find every Langflow instance:
pip list 2>/dev/null | grep -i langflowon hosts, and check container images and notebook environments. - Remove public access. Put Langflow behind a VPN or an authenticating proxy, and block the validate route at the proxy if you do not need it.
- Do not run it as root. The advisory says code runs as root, so a container with a non-root user and a read-only filesystem limits what a hit can do.
- Check logs for POST requests to validate routes from unknown addresses, and treat any exposed instance as possibly compromised.
- Rotate the API keys, vector database credentials and model provider keys stored in flows on any exposed instance.
How this could have been avoided
- Authentication on every route. The attacker needed no account. Putting an identity-aware proxy in front closes the anonymous path no matter which endpoint has the bug.
- Do not execute submitted code in the server process. A validation step that calls Python's code execution on user input is itself the exploit. Validate by parsing syntax trees, not by running.
- Run as an unprivileged user in a sandbox. Root turned a code execution bug into full host control.
- Keep secrets out of the flow host. Short lived, scoped credentials limit what stealing them is worth.
Quick check
Does the ZDI advisory name a fixed Langflow version?
No. It records no vendor response and offers only one mitigation: restrict interaction with the product. Verify fix status in the vendor's release notes.
