CVE-2026-0769 — Langflow: an unpatched pre-auth eval-injection RCE that VulnCheck observes being exploited, and that CISA KEV does not list
Two facts about the same identifier, published six months apart, combine into something a vulnerability-management process organised around CISA KEV will not see. The first: CVE-2026-0769 is an eval injection in Langflow's eval_custom_component_code function, where a user-supplied string reaches Python execution without proper validation, and Zero Day Initiative states plainly that authentication is not required to exploit it (Zero Day Initiative, 2026-01-09). ZDI published it as a 0-day advisory — its disclosure timeline records the report going to the vendor in July 2025, two follow-up requests over the following months, and then notice of intent to publish as a 0-day advisory — and its mitigation guidance is correspondingly blunt: restrict interaction with the product, because there is nothing to upgrade to (Zero Day Initiative, 2026-01-09). The CVE record ZDI filed as CNA carries CVSS 9.8 and lists only the single tested version, 1.3.2, with a default status of unknown (MITRE CVE Record, 2026-01-23).
The second fact is that this is no longer theoretical. VulnCheck reports observing attackers use exploits against CVE-2026-0769 to gain initial access to Langflow, then harvest credentials — it assesses these as likely for services such as OpenAI and Claude — deploy cryptominers, and attempt lateral movement, and states explicitly that the vulnerability has not been added to CISA KEV (VulnCheck, 2026-07-28). That framing is worth carrying: VulnCheck describes Langflow here as an AI-workflow platform being targeted for the model-provider credentials it holds, which is a different economic motive from generic web-application RCE and explains the credential-then-cryptominer sequence.
The KEV gap is the part with immediate procedural consequence, and it comes with a trap. This pipeline verified the absence directly against the current catalog rather than relying on VulnCheck's assertion: KEV carries five Langflow entries, and CVE-2026-0769 is not one of them — but CVE-2026-0770 is, and it is a different vulnerability, one this pipeline already covers. Two identifiers differing in the final digit, one KEV-listed with a patch path and one neither listed nor patched, is exactly the shape that produces a false all-clear when a ticket is closed against the wrong record. Any process that answers "are we exposed to Langflow?" by checking KEV membership will return a clean result for the flaw that has no fix.
Detection: with no patch to apply, the operative telemetry is on the host and at its egress. Langflow runs Python, so the process-creation observable is the Langflow service process spawning children it has no business spawning — shells, package managers, download utilities, or a second Python interpreter outside the application's own worker pattern. In egress telemetry, look for outbound connections from the Langflow host to mining pools or to destinations unrelated to the model providers the application legitimately calls, and for authentication events at your model providers originating from addresses that are not the Langflow host. Triage: Langflow's whole purpose is executing user-authored component code, so "Python executing dynamic code" is the application working as designed and is not by itself a signal; the discriminators are the process's children stepping outside the interpreter, and egress to destinations the application has no configured relationship with. Hardening: the only preventive control ZDI offers is restricting who can reach the product at all, which for most estates means removing internet exposure entirely and putting authenticated proxy access in front of the remainder.
With LangFlow, we've seen attackers gain initial access using exploits targeting both CVE-2026-0769 and CVE-2026-5027, harvest credentials, likely for services such as OpenAI and Claude, deploy cryptominers, and attempt lateral movement. Neither of these vulnerabilities have been added to CISA KEV.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process.
Defender actions
- Take every self-hosted Langflow instance off any internet-reachable interface — ZDI documents no fixed version and names restricting interaction with the product as the only mitigation, so network position is the whole of the available control.
- On any Langflow host that was internet-exposed, rotate the LLM-provider API keys and any other service credentials that instance held or could read: VulnCheck reports credential harvesting as observed post-exploitation behaviour, and those keys are billable and usable from anywhere.
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
Credential Access TA0006
T1552Unsecured Credentials
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).
Impact TA0040
T1496Resource Hijacking
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.