--- schema: 1 kind: vulnerability title: > CVE-2026-0770 — Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1 headline: > CISA KEV-lists a third Langflow RCE as IBM patches 15 more, including an unauthenticated superuser-account-creation path to code execution summary: > CISA added CVE-2026-0770 (CVSS 9.8) to its KEV catalog on 2026-07-21, confirming in-the-wild exploitation of an unauthenticated Python code-execution flaw in the self-hosted Langflow AI-agent platform's /api/v1/validate/code endpoint; the same day NCSC-NL disclosed 15 further CVEs (fixed in Langflow OSS 1.10.1), including an unauthenticated account-creation flaw (CVE-2026-9202) that reaches code execution. Any organisation self-hosting Langflow — increasingly EU/CH public-sector and research bodies building internal LLM/agent pipelines — must upgrade to 1.10.1 and close the AUTO_LOGIN / default-credential exposure. discovered_at: "2026-07-22T04:34:31Z" updated_at: "2026-08-05T04:12:23Z" event_date: 2026-07-21 run_id: 2026-07-22T0409Z-intel priority: high immediate_action: null tags: - vulnerabilities - rce - actively-exploited - cisa-kev - pre-auth - patch-available - auth-bypass - ai-abuse regions: - global - europe sectors: - technology - public-sector - education entities: [] techniques: - T1190 - T1059.006 - T1136 - T1552.001 affected_products: - Langflow - Langflow OSS - Langflow Desktop - IBM Langflow OSS - IBM Langflow cves: - id: CVE-2026-0770 cvss: "9.8" epss: null type: rce vector: zero-click auth: pre-auth status: - exploited - cisa-kev affected: "Langflow with AUTO_LOGIN=true and unchanged default credentials" fixed: no version patch — mitigated by disabling AUTO_LOGIN / rotating default credentials - id: CVE-2026-9202 cvss: "9.8" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: - patch-available affected: 1.0.0 – 1.10.0 fixed: 1.10.1 - id: CVE-2026-8859 cvss: "9.9" epss: null type: path-traversal vector: zero-click auth: post-auth status: - patch-available affected: 1.0.0 – 1.10.0 fixed: 1.10.1 - id: CVE-2026-9135 cvss: "9.9" epss: null type: rce vector: zero-click auth: post-auth status: - patch-available affected: 1.0.0 – 1.10.0 fixed: 1.10.1 - id: CVE-2026-14499 cvss: "8.8" epss: null type: rce vector: zero-click auth: post-auth status: - patch-available affected: IBM Langflow OSS 1.0.0 through 1.10.1 fixed: 1.10.2 - id: CVE-2026-9198 cvss: "9.8" epss: null type: rce vector: zero-click auth: pre-auth status: - exploited - cisa-kev - patch-available affected: "Langflow OSS 1.0.0 through 1.10.0, per IBM's security bulletin." fixed: > IBM's bulletin names Langflow OSS 1.10.1. Target 1.10.2 in practice — this pipeline's 2026-07-26 correction established that the sibling flaw CVE-2026-14499 is only fixed in 1.10.2. sources: - url: "https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog" publisher: CISA date: 2026-07-21 role: primary - url: "https://www.zerodayinitiative.com/advisories/ZDI-26-036/" publisher: Zero Day Initiative (Trend Micro) date: 2026-01-09 role: primary - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0251" publisher: NCSC-NL date: 2026-07-21 role: primary - url: "https://www.ibm.com/support/pages/node/7279996" publisher: IBM Security Bulletin date: 2026-07-14 role: primary - url: "https://www.ibm.com/support/pages/node/7278927" publisher: IBM PSIRT date: 2026-07-02 role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog" publisher: CISA date: 2026-08-04 role: corroborating closed_sources: [] evidence: - quote: The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. publisher: Zero Day Initiative (Trend Micro) - quote: CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability publisher: CISA - quote: Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component. publisher: IBM Security Bulletin - quote: Authentication is not required to exploit this vulnerability. publisher: Zero Day Initiative (Trend Micro) - quote: IBM Langflow Code Injection Vulnerability publisher: CISA - quote: based on evidence of active exploitation publisher: CISA verification: multi-source sourcing_note: > Exploitation confirmed by CISA KEV addition (2026-07-21); root cause and CVSS from the ZDI-26-036 per-vulnerability advisory (disclosed as a zero-day 2026-01-09 after six months of unanswered vendor contact); the 15-CVE batch and its fixed version from NCSC-2026-0251 / IBM Security Bulletins. CVE-2026-0770 is a deployment-misconfiguration flaw (unauthenticated only where AUTO_LOGIN=true retains default credentials), which is why no dedicated version patch closes it. confidence: high references: - 2026-07-29/cve-2026-0769-langflow-preauth-eval-rce-exploited-not-in-kev deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Upgrade every self-hosted Langflow instance to OSS 1.10.1; on any instance where AUTO_LOGIN must remain enabled, rotate the default langflow/langflow credentials and set NEW_USER_IS_ACTIVE=false — patching alone does not close CVE-2026-0770, and CVE-2026-9202 lets unauthenticated attackers self-provision active accounts otherwise." - "Upgrade self-hosted Langflow to OSS 1.10.2 rather than 1.10.1 — CVE-2026-14499 (CVSS 8.8, authenticated command injection in the Python Interpreter component) affects 1.0.0 through 1.10.1 inclusive, so an estate that followed the earlier 1.10.1 guidance is still exposed to it." - "Take self-hosted Langflow instances off the public internet rather than patching them in place — three separate pre-authentication code-execution paths in this product are now confirmed exploited, and one of them still has no fixed version." updates: - at: "2026-07-26T14:06:00Z" run_id: 2026-07-26T1308Z-audit type: correction summary: > Two corrections to this pipeline's 2026-07-22 Langflow coverage, both affecting what a defender should do. First, the July CVE batch is not all fixed in 1.10.1: CVE-2026-14499, an authenticated command injection in the Python Interpreter component at CVSS 8.8, affects Langflow OSS 1.0.0 through 1.10.1 and is fixed in 1.10.2 — so upgrading to 1.10.1 as previously advised leaves it open. Second, CVE-2026-0770 was described as requiring AUTO_LOGIN=true with unchanged default credentials and having no version patch; the discloser's own advisory states authentication is not required and imposes no configuration precondition, and the "no version patch" status reflects the discloser's January position rather than the current remediation, which is the upgrade. fields: - actions - affected_products - cves - evidence - sources - body merged_from: 2026-07-26/langflow-1-10-2-required-cve-2026-0770-precondition-fix - at: "2026-08-05T04:12:23Z" run_id: 2026-08-05T0412Z-intel type: update summary: > CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on 2026-08-04, listing it as an IBM Langflow code-injection flaw. It is a distinct path from the Langflow flaws already covered here: an unauthenticated caller reaches an auto-login endpoint that issues a superuser token, then submits Python to a code-validation endpoint which executes it during function definition. IBM's bulletin rates it CVSS 9.8 and affects Langflow OSS 1.0.0 through 1.10.0. This is the third confirmed-exploited pre-authentication path in the same product inside three weeks, which turns the question from patching a CVE into removing the product's internet exposure. fields: - actions - affected_products - cves - evidence - references - regions - sectors - sources - tags - body merged_from: 2026-08-05/cve-2026-9198-langflow-auto-login-validate-code-kev migrated_from: null --- CISA added **CVE-2026-0770** (CVSS 9.8) to its Known Exploited Vulnerabilities catalog on 2026-07-21, confirming in-the-wild exploitation of a flaw that Zero Day Initiative disclosed as an unpatched zero-day on 2026-01-09 ([CISA, 2026-07-21](https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog)). The flaw sits in the `POST /api/v1/validate/code` endpoint: the `exec_globals` parameter is passed to Langflow's code-validation handler and executed via Python `exec()` without sandboxing, giving code execution in the context of root ([Zero Day Initiative, 2026-01-09](https://www.zerodayinitiative.com/advisories/ZDI-26-036/)). Exploitation is unauthenticated only where the operator runs `AUTO_LOGIN=true` and has retained Langflow's documented default credentials — a deployment misconfiguration, which is why the durable fix is disabling `AUTO_LOGIN` or rotating the default account rather than a version bump. The same day, NCSC-NL published NCSC-2026-0251 covering **15 further CVEs** across IBM Langflow OSS 1.0.0 through 1.10.0, all fixed in **1.10.1** ([NCSC-NL, 2026-07-21](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0251)). The batch includes an unauthenticated missing-authentication flaw (**CVE-2026-9202**, CVSS 9.8) that lets an attacker create unlimited accounts on any instance and — where the documented `NEW_USER_IS_ACTIVE=true` option is set — immediately activate them to reach RCE endpoints, bypassing `AUTO_LOGIN` restrictions entirely; a path-traversal arbitrary file write in the APIRequest "Save to File" feature via unsanitised Content-Disposition filenames (**CVE-2026-8859**, CVSS 9.9); a code-injection flaw in the Policies/ToolGuard component whose guard-field validation covered only the main code field and not dynamic CodeInput fields (**CVE-2026-9135**, CVSS 9.9); an SSRF from insecure defaults (CVE-2026-7754); RCE via insufficient validation of MCP server configuration files (CVE-2026-7755); and unsafe deserialization in the AsyncDiskCache class reachable through `apply_tweaks()` parameter override (CVE-2026-8476). Langflow has repeatedly drawn CISA KEV listings in 2026 — earlier additions include CVE-2026-33017 and CVE-2026-55255 — reflecting how the platform's exposure as a self-hosted AI-agent orchestrator holding embedded credentials and broad system permissions keeps drawing both attackers and researchers. **Defender takeaway:** self-hosted Langflow is an internet-reachable code-execution surface, and the current exploitation is against exactly the default-friendly deployments (AUTO_LOGIN with unrotated credentials) that internal LLM/agent projects stand up quickly. Detection concept, telemetry-class first: in web/application access logs, surface unauthenticated or scripted `POST` requests to `/api/v1/validate/code` (any request body carrying an `exec_globals` key), to `/api/v1/login/auto_login`, and any account-creation calls not originating from an authenticated browser UI session; in process-creation telemetry with parent lineage, alert on OS processes (a shell, `python`, network utilities) spawned by the Langflow service account, the webshell/reverse-shell pattern that follows a successful `exec_globals` call. **Triage:** legitimate flow-authoring traffic to `/api/v1/validate/code` comes from authenticated UI sessions with a browser user-agent and Referer; unauthenticated POSTs or any request carrying `exec_globals` are the discriminator. ## Correction — 2026-07-26T14:06:00Z Two corrections to that entry, both of which change what a defender does. This entry supersedes its guidance on the points below; the rest of it stands. **The fix line is 1.10.2, not 1.10.1.** The earlier entry described the July batch as fixed in Langflow OSS 1.10.1 and its action item advised upgrading to that release. At least one CVE in the same batch is not covered by it: CVE-2026-14499 "could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component", affects "Langflow OSS 1.0.0-1.10.1" at CVSS 8.8, and IBM "strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.2" ([IBM Security Bulletin, 2026-07-14](https://www.ibm.com/support/pages/node/7279996)). Because 1.10.1 is inside the affected range rather than outside it, an estate that acted on the earlier guidance is patched against the rest of the batch and still exposed to this one. The component is the Python Interpreter node, so the exposure is largest wherever Langflow flows are authored or run by more than a small set of trusted operators — an authenticated user is the only prerequisite. **CVE-2026-0770 does not depend on AUTO_LOGIN.** The earlier entry recorded that CVE's affected condition as Langflow running with `AUTO_LOGIN=true` and unchanged default credentials, and recorded no version patch, framing the remediation as disabling AUTO_LOGIN and rotating credentials. The discloser's own per-vulnerability advisory contradicts the precondition: "Authentication is not required to exploit this vulnerability", with the flaw located in the handling of the `exec_globals` parameter passed to the validate endpoint, scored CVSS 9.8, and no configuration prerequisite stated anywhere in the advisory ([Zero Day Initiative, 2026-01-09](https://www.zerodayinitiative.com/advisories/ZDI-26-036/)). ZDI's advisory does say that, at its January publication, "Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product" ([Zero Day Initiative, 2026-01-09](https://www.zerodayinitiative.com/advisories/ZDI-26-036/)) — which is where the "no version patch" line came from, and which reflects the position in January rather than today. So the practical correction is narrower than "the status was wrong": the entry carried a six-month-old mitigation posture as current, when the operative remediation now is the version upgrade that this entry's other correction already requires. **Defender takeaway:** upgrade to 1.10.2. Treat the AUTO_LOGIN and default-credential hardening as worthwhile in its own right — an internet-reachable Langflow with automatic login and shipped credentials is exposed regardless of CVE numbering — but not as the control that closes CVE-2026-0770, which is reachable without authentication and closed by patching. For triage purposes the practical consequence of the correction is that a Langflow instance cannot be cleared on the basis of "AUTO_LOGIN is disabled": the version is what determines exposure. **Triage:** for CVE-2026-14499 the observable is command execution parented by the Langflow application process — a Python interpreter or shell child spawned from the Langflow server rather than from an operator's terminal. Legitimate use of the Python Interpreter component produces the same shape, which is why the discriminator is the account and the content rather than the lineage alone: executions attributed to a user who does not normally author flows, or occurring outside the hours when flows are edited, are the reviewable set. Version inventory is the higher-signal check here — an instance on 1.10.1 or earlier is affected regardless of what its telemetry shows. ## Update — 2026-08-05T04:12:23Z CISA added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog on 2026-08-04, listing it as an IBM Langflow code-injection vulnerability, with the additions made on evidence of active exploitation ([CISA, 2026-08-04](https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog)). This is a different path from anything covered in the earlier Langflow entries, which dealt with the exec_globals code-execution endpoint and a Python-interpreter component flaw. The chain here has two links, and the first is the reason there is nothing to brute-force: an unauthenticated caller reaches an auto-login endpoint that issues a superuser token, and then submits Python to a code-validation endpoint that executes what it is given during function definition — through decorators, default arguments and annotations, all of which run at definition time rather than at call time. IBM's bulletin rates the result CVSS 9.8 and records the affected range as Langflow OSS 1.0.0 through 1.10.0 ([IBM PSIRT, 2026-07-02](https://www.ibm.com/support/pages/node/7278927)). IBM names 1.10.1 as the remediation for this flaw; operators should target 1.10.2, because this pipeline's 2026-07-26 correction established that the sibling flaw CVE-2026-14499 is only closed in 1.10.2. **The count is now the story.** Three separate pre-authentication code-execution paths in this one product carry confirmed exploitation — CVE-2026-0770, CVE-2026-0769 and now CVE-2026-9198 — and CVE-2026-0769 still has no documented fixed version at all. A product whose unauthenticated attack surface has yielded three exploited paths in three weeks is not being picked at opportunistically; it is being worked systematically, and each individual patch buys less than the pattern costs. Detection concepts, telemetry class first. The full chain appears in web and application access logs as two requests: an unauthenticated POST to the auto-login endpoint followed immediately by a POST to the code-validation endpoint from the same source. On the host, process-creation telemetry showing the Langflow Python or application-server process spawning a shell is the payoff stage. **Triage:** the auto-login endpoint exists to serve a legitimate single-user convenience mode, so requests to it are not inherently malicious on an instance configured that way. The discriminator is what follows: a code-validation submission arriving from the same source within the same second, from an address outside the deployment's expected client range. **Defender takeaway:** the operational answer for this product is exposure removal rather than version chasing. Langflow instances are typically stood up by teams prototyping LLM workflows on internal or cloud virtual machines, frequently reachable from the internet by accident rather than by design, and rarely in the asset inventory that drives patching. Find them, put them behind authentication that the application does not control, and upgrade to 1.10.2 — in that order, because the first step is the one that holds when the fourth path is disclosed.