CVE-2026-9202 — Langflow OSS: unauthenticated account creation reaching RCE (fixed 1.10.1)

CVE-2026-0770 — Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1

CISA added CVE-2026-0770 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog on 2026-07-21, confirming in-the-wild exploitation of a flaw that Zero Day Initiative disclosed as an unpatched zero-day on 2026-01-09 (CISA, 2026-07-21). The flaw sits in the POST /api/v1/validate/code endpoint: the exec_globals parameter is passed to Langflow's code-validation handler and executed via Python exec() without sandboxing, giving code execution in the context of root (Zero Day Initiative, 2026-01-09). Exploitation is unauthenticated only where the operator runs AUTO_LOGIN=true and has retained Langflow's documented default credentials — a deployment misconfiguration, which is why the durable fix is disabling AUTO_LOGIN or rotating the default account rather than a version bump.

The same day, NCSC-NL published NCSC-2026-0251 covering 15 further CVEs across IBM Langflow OSS 1.0.0 through 1.10.0, all fixed in 1.10.1 (NCSC-NL, 2026-07-21). The batch includes an unauthenticated missing-authentication flaw (CVE-2026-9202, CVSS 9.8) that lets an attacker create unlimited accounts on any instance and — where the documented NEW_USER_IS_ACTIVE=true option is set — immediately activate them to reach RCE endpoints, bypassing AUTO_LOGIN restrictions entirely; a path-traversal arbitrary file write in the APIRequest "Save to File" feature via unsanitised Content-Disposition filenames (CVE-2026-8859, CVSS 9.9); a code-injection flaw in the Policies/ToolGuard component whose guard-field validation covered only the main code field and not dynamic CodeInput fields (CVE-2026-9135, CVSS 9.9); an SSRF from insecure defaults (CVE-2026-7754); RCE via insufficient validation of MCP server configuration files (CVE-2026-7755); and unsafe deserialization in the AsyncDiskCache class reachable through apply_tweaks() parameter override (CVE-2026-8476). Langflow has repeatedly drawn CISA KEV listings in 2026 — earlier additions include CVE-2026-33017 and CVE-2026-55255 — reflecting how the platform's exposure as a self-hosted AI-agent orchestrator holding embedded credentials and broad system permissions keeps drawing both attackers and researchers.