2026-07-22 · view entry permalink →
CVE-2026-0770, Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1
CISA added CVE-2026-0770 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog on 2026-07-21, confirming in-the-wild exploitation of a flaw that Zero Day Initiative disclosed as an unpatched zero-day on 2026-01-09 (CISA, 2026-07-21). The flaw sits in the POST /api/v1/validate/code endpoint: the exec_globals parameter is passed to Langflow's code-validation handler and executed via Python exec() without sandboxing, giving code execution in the context of root (Zero Day Initiative, 2026-01-09). Exploitation is unauthenticated only where the operator runs AUTO_LOGIN=true and has retained Langflow's documented default credentials, a deployment misconfiguration, which is why the durable fix is disabling AUTO_LOGIN or rotating the default account rather than a version bump.
The same day, NCSC-NL published NCSC-2026-0251 covering 15 further CVEs across IBM Langflow OSS 1.0.0 through 1.10.0, all fixed in 1.10.1 (NCSC-NL, 2026-07-21). The batch includes an unauthenticated missing-authentication flaw (CVE-2026-9202, CVSS 9.8) that lets an attacker create unlimited accounts on any instance and (where the documented NEW_USER_IS_ACTIVE=true option is set) immediately activate them to reach RCE endpoints, bypassing AUTO_LOGIN restrictions entirely; a path-traversal arbitrary file write in the APIRequest "Save to File" feature via unsanitised Content-Disposition filenames (CVE-2026-8859, CVSS 9.9); a code-injection flaw in the Policies/ToolGuard component whose guard-field validation covered only the main code field and not dynamic CodeInput fields (CVE-2026-9135, CVSS 9.9); an SSRF from insecure defaults (CVE-2026-7754); RCE via insufficient validation of MCP server configuration files (CVE-2026-7755); and unsafe deserialization in the AsyncDiskCache class reachable through apply_tweaks() parameter override (CVE-2026-8476). Langflow has repeatedly drawn CISA KEV listings in 2026 (earlier additions include CVE-2026-33017 and CVE-2026-55255) reflecting how the platform's exposure as a self-hosted AI-agent orchestrator holding embedded credentials and broad system permissions keeps drawing both attackers and researchers.
The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root.
CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.
Authentication is not required to exploit this vulnerability.
IBM Langflow Code Injection Vulnerability
based on evidence of active exploitation
Two corrections to that entry, both of which change what a defender does. This entry supersedes its guidance on the points below; the rest of it stands.
The fix line is 1.10.2, not 1.10.1. The earlier entry described the July batch as fixed in Langflow OSS 1.10.1 and its action item advised upgrading to that release. At least one CVE in the same batch is not covered by it: CVE-2026-14499 "could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component", affects "Langflow OSS 1.0.0-1.10.1" at CVSS 8.8, and IBM "strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2" (IBM Security Bulletin, 2026-07-14). Because 1.10.1 is inside the affected range rather than outside it, an estate that acted on the earlier guidance is patched against the rest of the batch and still exposed to this one. The component is the Python Interpreter node, so the exposure is largest wherever Langflow flows are authored or run by more than a small set of trusted operators; an authenticated user is the only prerequisite.
CVE-2026-0770 does not depend on AUTO_LOGIN. The earlier entry recorded that CVE's affected condition as Langflow running with AUTO_LOGIN=true and unchanged default credentials, and recorded no version patch, framing the remediation as disabling AUTO_LOGIN and rotating credentials. The discloser's own per-vulnerability advisory contradicts the precondition: "Authentication is not required to exploit this vulnerability", with the flaw located in the handling of the exec_globals parameter passed to the validate endpoint, scored CVSS 9.8, and no configuration prerequisite stated anywhere in the advisory (Zero Day Initiative, 2026-01-09). ZDI's advisory does say that, at its January publication, "Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product" (Zero Day Initiative, 2026-01-09), which is where the "no version patch" line came from, and which reflects the position in January rather than today. So the practical correction is narrower than "the status was wrong": the entry carried a six-month-old mitigation posture as current, when the operative remediation now is the version upgrade that this entry's other correction already requires.
Triage: for CVE-2026-14499 the observable is command execution parented by the Langflow application process, a Python interpreter or shell child spawned from the Langflow server rather than from an operator's terminal. Legitimate use of the Python Interpreter component produces the same shape, which is why the discriminator is the account and the content rather than the lineage alone: executions attributed to a user who does not normally author flows, or occurring outside the hours when flows are edited, are the reviewable set. Version inventory is the higher-signal check here, an instance on 1.10.1 or earlier is affected regardless of what its telemetry shows.
CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on 2026-08-04, listing it as an IBM Langflow code-injection vulnerability, with the additions made on evidence of active exploitation (CISA, 2026-08-04). This is a different path from anything covered in the earlier Langflow entries, which dealt with the exec_globals code-execution endpoint and a Python-interpreter component flaw.
The chain here has two links, and the first is the reason there is nothing to brute-force: an unauthenticated caller reaches an auto-login endpoint that issues a superuser token, and then submits Python to a code-validation endpoint that executes what it is given during function definition, through decorators, default arguments and annotations, all of which run at definition time rather than at call time. IBM's bulletin rates the result CVSS 9.8 and records the affected range as Langflow OSS 1.0.0 through 1.10.0 (IBM PSIRT, 2026-07-02). IBM names 1.10.1 as the remediation for this flaw; operators should target 1.10.2, because this pipeline's 2026-07-26 correction established that the sibling flaw CVE-2026-14499 is only closed in 1.10.2.
The count is now the story. Three separate pre-authentication code-execution paths in this one product carry confirmed exploitation (CVE-2026-0770, CVE-2026-0769 and now CVE-2026-9198) and CVE-2026-0769 still has no documented fixed version at all. A product whose unauthenticated attack surface has yielded three exploited paths in three weeks is not being picked at opportunistically; it is being worked systematically, and each individual patch buys less than the pattern costs.
Detection concepts, telemetry class first. The full chain appears in web and application access logs as two requests: an unauthenticated POST to the auto-login endpoint followed immediately by a POST to the code-validation endpoint from the same source. On the host, process-creation telemetry showing the Langflow Python or application-server process spawning a shell is the payoff stage.
Triage: the auto-login endpoint exists to serve a legitimate single-user convenience mode, so requests to it are not inherently malicious on an instance configured that way. The discriminator is what follows: a code-validation submission arriving from the same source within the same second, from an address outside the deployment's expected client range.
Builds on: 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev