Langflow eval_custom_component_code eval injection (CVSS 9.8, CWE-95) — unauthenticated RCE, published by ZDI as a 0-day advisory with no fixed version documented anywhere and "restrict interaction with the product" as the only stated mitigation; VulnCheck reports observed exploitation for credential harvesting, cryptomining and lateral movement; NOT in CISA KEV (distinct from the KEV-listed CVE-2026-0770)

CVE-2026-0769 — Langflow: an unpatched pre-auth eval-injection RCE that VulnCheck observes being exploited, and that CISA KEV does not list

Two facts about the same identifier, published six months apart, combine into something a vulnerability-management process organised around CISA KEV will not see. The first: CVE-2026-0769 is an eval injection in Langflow's eval_custom_component_code function, where a user-supplied string reaches Python execution without proper validation, and Zero Day Initiative states plainly that authentication is not required to exploit it (Zero Day Initiative, 2026-01-09). ZDI published it as a 0-day advisory — its disclosure timeline records the report going to the vendor in July 2025, two follow-up requests over the following months, and then notice of intent to publish as a 0-day advisory — and its mitigation guidance is correspondingly blunt: restrict interaction with the product, because there is nothing to upgrade to (Zero Day Initiative, 2026-01-09). The CVE record ZDI filed as CNA carries CVSS 9.8 and lists only the single tested version, 1.3.2, with a default status of unknown (MITRE CVE Record, 2026-01-23).

The second fact is that this is no longer theoretical. VulnCheck reports observing attackers use exploits against CVE-2026-0769 to gain initial access to Langflow, then harvest credentials — it assesses these as likely for services such as OpenAI and Claude — deploy cryptominers, and attempt lateral movement, and states explicitly that the vulnerability has not been added to CISA KEV (VulnCheck, 2026-07-28). That framing is worth carrying: VulnCheck describes Langflow here as an AI-workflow platform being targeted for the model-provider credentials it holds, which is a different economic motive from generic web-application RCE and explains the credential-then-cryptominer sequence.

The KEV gap is the part with immediate procedural consequence, and it comes with a trap. This pipeline verified the absence directly against the current catalog rather than relying on VulnCheck's assertion: KEV carries five Langflow entries, and CVE-2026-0769 is not one of them — but CVE-2026-0770 is, and it is a different vulnerability, one this pipeline already covers. Two identifiers differing in the final digit, one KEV-listed with a patch path and one neither listed nor patched, is exactly the shape that produces a false all-clear when a ticket is closed against the wrong record. Any process that answers "are we exposed to Langflow?" by checking KEV membership will return a clean result for the flaw that has no fix.

Detection: with no patch to apply, the operative telemetry is on the host and at its egress. Langflow runs Python, so the process-creation observable is the Langflow service process spawning children it has no business spawning — shells, package managers, download utilities, or a second Python interpreter outside the application's own worker pattern. In egress telemetry, look for outbound connections from the Langflow host to mining pools or to destinations unrelated to the model providers the application legitimately calls, and for authentication events at your model providers originating from addresses that are not the Langflow host. Triage: Langflow's whole purpose is executing user-authored component code, so "Python executing dynamic code" is the application working as designed and is not by itself a signal; the discriminators are the process's children stepping outside the interpreter, and egress to destinations the application has no configured relationship with. Hardening: the only preventive control ZDI offers is restricting who can reach the product at all, which for most estates means removing internet exposure entirely and putting authenticated proxy access in front of the remainder.

Builds on: 2026-06-11/cve-2026-5027-langflow-unauthenticated-path-traversal-to-arb · 2026-07-22/langflow-cve-2026-0770-exploited-ncsc-nl-15-cve-batch