CVE-2026-0769 in Langflow: a pre-auth eval-injection RCE with no documented fix that VulnCheck observes being exploited, and that CISA KEV does not list

Two facts about the same identifier, published six months apart, combine into something a vulnerability-management process organised around CISA KEV will not see. The first: CVE-2026-0769 is an eval injection in Langflow's eval_custom_component_code function, where a user-supplied string reaches Python execution without proper validation, and Zero Day Initiative states plainly that authentication is not required to exploit it (Zero Day Initiative, 2026-01-09). ZDI published it as a 0-day advisory. Its disclosure timeline records the report going to the vendor in July 2025, two follow-up requests over the following months and then notice of intent to publish, and its mitigation guidance is correspondingly blunt: restrict interaction with the product, given the nature of the vulnerability (Zero Day Initiative, 2026-01-09). ZDI scores it CVSS 9.8 and its advisory names no affected or fixed version (Zero Day Initiative, 2026-01-09); ZDI's CVE record lists Langflow 1.3.2 as the only affected version, a single listed version rather than a range (ENISA EUVD, EUVD-2026-4475).

The second fact is that this is no longer theoretical. VulnCheck reports observing attackers gain initial access to Langflow with exploits targeting both CVE-2026-0769 and a second Langflow flaw, CVE-2026-5027, then harvest credentials, which it assesses as likely for services such as OpenAI and Claude, deploy cryptominers, and attempt lateral movement; it does not say which flaw each intrusion used, and states explicitly that neither has been added to CISA KEV (VulnCheck, 2026-07-28). Neither ZDI's advisory nor VulnCheck's report includes exploit code (Zero Day Initiative, 2026-01-09) (VulnCheck, 2026-07-28). That detail is worth carrying: if the harvested credentials are model-provider keys, a compromised Langflow instance also exposes the AI-service accounts it is wired to, not only the host.

The KEV gap is the part with immediate procedural consequence, and it comes with a trap. As of the catalog of 2026-09-29, KEV lists six Langflow CVEs: CVE-2026-9198, CVE-2026-0770, CVE-2026-55255, CVE-2025-34291, CVE-2026-33017 and CVE-2025-3248 (CISA KEV catalog, 2026-09-29). CVE-2026-0769 is not one of them, while CVE-2026-0770, the next CVE number, is a different vulnerability. A pair of consecutive identifiers, one KEV-listed and one neither KEV-listed nor documented as fixed, is exactly the shape that produces a false all-clear when a ticket is closed against the wrong record. Any process that answers "are we exposed to Langflow?" by checking KEV membership will return a clean result for the flaw with no documented fix.