Langflow eval_custom_component_code eval injection (CVSS 9.8, CWE-95), unauthenticated RCE, published by ZDI as a 0-day advisory with no fixed version documented anywhere and "restrict interaction with the product" as the only stated mitigation; VulnCheck reports observed exploitation for credential harvesting, cryptomining and lateral movement; NOT in CISA KEV (distinct from the KEV-listed CVE-2026-0770)

cve · CVE-2026-0769

Coverage

first 2026-07-29 → last 2026-10-21

Latest activity

2026-07-29

VulnCheck's canaries show attackers exploiting a Langflow pre-auth RCE with no documented fix and no KEV…

Peak priority

high

1 high

Targets

technology

sectors: technology, public-sector, finance

Sources cited

4 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-0769, newest first. Check the date before acting on an older one.

Take every self-hosted Langflow instance off any internet-reachable interface: ZDI documents no fixed version and names restricting interaction with the product as the only mitigation, so network position is the whole of the available control.
2026-07-29CVE-2026-0769
On any Langflow host that was internet-exposed, rotate the LLM-provider API keys and any other service credentials that instance held or could read: VulnCheck reports credential harvesting as observed post-exploitation behaviour, and those keys are billable and usable from anywhere.
2026-07-29CVE-2026-0769

Defender insights

What each entry about CVE-2026-0769 tells a defender to do, newest first.

2026-07-29HIGHexploitedVulnCheck's canaries show attackers exploiting a Langflow pre-auth RCE with no documented fix and no KEV entry, while the next CVE number is KEV-listed

Exposure · triage · detection

Story timeline

2026-07-29CVE-2026-0769 in Langflow: a pre-auth eval-injection RCE with no documented fix that VulnCheck observes being exploited, and that CISA KEV does not list
trending-vulnerabilitiesVulnCheck's canaries show attackers exploiting a Langflow pre-auth RCE with no documented fix and no KEV entry, while the next CVE number is KEV-listed

Hunting pivots

Affected products

Langflow

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev · ATT&CK page ↗

Credential Access TA0006

T1552Unsecured Credentials×1

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

Evidence: 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev · ATT&CK page ↗

Impact TA0040

T1496Resource Hijacking×1

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Evidence: 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev · ATT&CK page ↗

Entries about Langflow eval_custom_component_code eval injection (CVSS 9.8, CWE-95), unauthenticated RCE, published by ZDI as a 0-day advisory with no fixed version documented anywhere and "restrict interaction with the product" as the only stated mitigation; VulnCheck reports observed exploitation for credential harvesting, cryptomining and lateral movement; NOT in CISA KEV (distinct from the KEV-listed CVE-2026-0770) (1)

2026-07-29 · view entry permalink →

HIGHCVE-2026-0769exploitedupdatedNATOB2

CVE-2026-0769 in Langflow: a pre-auth eval-injection RCE with no documented fix that VulnCheck observes being exploited, and that CISA KEV does not list

Two facts about the same identifier, published six months apart, combine into something a vulnerability-management process organised around CISA KEV will not see. The first: CVE-2026-0769 is an eval injection in Langflow's eval_custom_component_code function, where a user-supplied string reaches Python execution without proper validation, and Zero Day Initiative states plainly that authentication is not required to exploit it (Zero Day Initiative, 2026-01-09). ZDI published it as a 0-day advisory. Its disclosure timeline records the report going to the vendor in July 2025, two follow-up requests over the following months and then notice of intent to publish, and its mitigation guidance is correspondingly blunt: restrict interaction with the product, given the nature of the vulnerability (Zero Day Initiative, 2026-01-09). ZDI scores it CVSS 9.8 and its advisory names no affected or fixed version (Zero Day Initiative, 2026-01-09); ZDI's CVE record lists Langflow 1.3.2 as the only affected version, a single listed version rather than a range (ENISA EUVD, EUVD-2026-4475).

The second fact is that this is no longer theoretical. VulnCheck reports observing attackers gain initial access to Langflow with exploits targeting both CVE-2026-0769 and a second Langflow flaw, CVE-2026-5027, then harvest credentials, which it assesses as likely for services such as OpenAI and Claude, deploy cryptominers, and attempt lateral movement; it does not say which flaw each intrusion used, and states explicitly that neither has been added to CISA KEV (VulnCheck, 2026-07-28). Neither ZDI's advisory nor VulnCheck's report includes exploit code (Zero Day Initiative, 2026-01-09) (VulnCheck, 2026-07-28). That detail is worth carrying: if the harvested credentials are model-provider keys, a compromised Langflow instance also exposes the AI-service accounts it is wired to, not only the host.

The KEV gap is the part with immediate procedural consequence, and it comes with a trap. As of the catalog of 2026-09-29, KEV lists six Langflow CVEs: CVE-2026-9198, CVE-2026-0770, CVE-2026-55255, CVE-2025-34291, CVE-2026-33017 and CVE-2025-3248 (CISA KEV catalog, 2026-09-29). CVE-2026-0769 is not one of them, while CVE-2026-0770, the next CVE number, is a different vulnerability. A pair of consecutive identifiers, one KEV-listed and one neither KEV-listed nor documented as fixed, is exactly the shape that produces a false all-clear when a ticket is closed against the wrong record. Any process that answers "are we exposed to Langflow?" by checking KEV membership will return a clean result for the flaw with no documented fix.

Detection

With no documented fix, the operative telemetry is on the host and at its egress. Langflow runs Python, so the process-creation observable is the Langflow service process spawning children it has no business spawning: shells, package managers, download utilities, or a second Python interpreter outside the application's own worker pattern. In egress telemetry, look for outbound connections from the Langflow host to mining pools or to destinations unrelated to the model providers the application legitimately calls, and for authentication events at your model providers originating from addresses that are not the Langflow host. Triage: Langflow's whole purpose is executing user-authored component code, so "Python executing dynamic code" is the application working as designed and is not by itself a signal; the discriminators are the process's children stepping outside the interpreter, and egress to destinations the application has no configured relationship with.

With LangFlow, we've seen attackers gain initial access using exploits targeting both CVE-2026-0769 and CVE-2026-5027, harvest credentials, likely for services such as OpenAI and Claude, deploy cryptominers, and attempt lateral movement. Neither of these vulnerabilities have been added to CISA KEV.

VulnCheck 2026-07-28

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process.

Zero Day Initiative (ZDI-26-035) 2026-01-09

Correction30 Sep 2026 07:18 UTCrun 2026-09-30T0639Z-auditcvessourcing_notesourcesbodysummaryheadlinetitletags

The earlier text described the CVE record's contents, including a single tested version, 1.3.2. ZDI's advisory scores the flaw CVSS 9.8 and names no affected or fixed version (Zero Day Initiative, 2026-01-09). The earlier text also counted five Langflow CVEs in CISA's KEV catalog. The catalog of 2026-09-29 lists six (CISA KEV catalog, 2026-09-29), and CVE-2026-0769 is still not among them. Earlier statements that an OSV lookup finds no record and that the KEV-listed CVE-2026-0770 has a patch path had no source. The headline and main text called CVE-2026-0769 and CVE-2026-0770 one digit apart. They are consecutive numbers that differ in their last two digits.

Improvement21 Oct 2026 08:17 UTCrun 2026-10-21T0800Z-auditsummarycvessourcesactionsbody

VulnCheck's observation covers initial access with exploits targeting both CVE-2026-0769 and CVE-2026-5027, and it does not attribute the credential harvesting, cryptominers and lateral movement that followed to either flaw separately (VulnCheck, 2026-07-28). ZDI's advisory names no affected version, but ZDI's CVE record lists Langflow 1.3.2 as the only affected version, a single listed version rather than a range, so the affected range remains undefined (ENISA EUVD, EUVD-2026-4475).

Builds on: CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in… · CISA KEV-lists a third Langflow RCE as IBM patches 15 more, including an unauthenticated…

vulnerability29 Jul 05:20Zmulti-sourceOpen finding →

Sources: Zero Day Initiative (ZDI-26-035) · VulnCheck · CISA KEV catalog · ENISA EUVD

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Langflow×1
productproduct:langflow

Where this entity is cited

Vulns1

Source distribution

cisa.gov1 (25%)
euvd.enisa.europa.eu1 (25%)
vulncheck.com1 (25%)
zerodayinitiative.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)