Langflow
CVE-2026-0770
CRITICAL
GHSA-g22f-v6f7-2hrh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to validate endpoint
-
ExploitInject malicious exec_globals parameter
-
ImpactExecute arbitrary code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default Langflow installations with exposed validate endpoint accepting exec_globals parameter. |
| Impact | CVSS 9.8, EPSS 10.0% — very high exploitation probability. Three separate code execution paths in Langflow (code, eval, exec_globals) indicate fundamental architecture issues with user code execution. |
| Exploit ScenarioDerived | An attacker leverages the exec_globals vulnerability to execute code in Langflow's global Python scope, accessing all configuration, API keys, database connections, and LLM provider credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes in the application's global scope.
Earlier versions of this analysis (1)
Untrusted code inclusion in Langflow exec_globals enables RCE — highest EPSS in the Langflow series.
RemediationAI
Update Langflow immediately. This has the highest exploitation probability of the three Langflow RCE vulnerabilities.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Langflow's exec_globals function includes functionality from an untrusted control sphere (CWE-829), executing user-provided code in the application's global scope with full access to all imported modules and application state.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (trendmicro) · only source for this CVE.
CVSS VectorVendor: trendmicro
Lifecycle Timeline
2DescriptionCVE.org
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
Executive ViewAI
A critical remote code execution vulnerability in Langflow (CVE-2026-0770) allows unauthenticated attackers to execute arbitrary commands on affected systems with a 9.8 CVSS score and 10% exploitation probability. Any organization running Langflow is at immediate risk of complete system compromise, data theft, and operational disruption until mitigation measures are implemented.
- Restrict network access to Langflow instances to trusted internal networks only; 2) Deploy WAF rules to block or sanitize requests containing 'exec_globals' parameter to the validate endpoint; 3) Disable the validate endpoint entirely if operationally feasible; 4) Implement strict input validation and disable dynamic code execution features; 5) Monitor all requests to Langflow for suspicious patterns; 6) Consider operational shutdown of Langflow until patch is available if it is not business-critical.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers