Loading story…
A critical unauthenticated remote code execution flaw in Langflow, tracked as CVE-2026-0770, has been actively exploited against the platform’s /api/v1/validate/code endpoint. The vulnerability affects Langflow versions 0.0.31 through 1.7.3 and stems from unsafe use of Python’s exec() during server-side code validation, allowing attackers to submit crafted function definitions that execute arbitrary operating system commands. Reported post-exploitation activity included reconnaissance, credential theft, environment-variable collection, cloud metadata access, and retrieval of second-stage payloads.
CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog and directed U.S. federal civilian agencies to remediate it under BOD 26-04, while Langflow addressed the issue in its release-1.10.1 branch by replacing exec()-based validation with compile-only validation and adding regression tests. Separately, a Metasploit exploit module for the bug is under active development in the Rapid7 framework, increasing the likelihood of broader weaponization. Organizations with internet-facing Langflow deployments are being urged to patch immediately and investigate exposed systems as potentially compromised even after remediation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On August 4, 2026, a GitHub pull request for a Metasploit exploit module targeting Langflow CVE-2026-0770 showed active workflow tracking. Project automation moved the item across Kanban states, and contributor bhaskarbhar closed and then reopened it the same day.
On July 21, 2026, CISA added CVE-2026-0770, a critical unauthenticated RCE flaw in Langflow, to its Known Exploited Vulnerabilities Catalog. CISA also required Federal Civilian Executive Branch agencies to remediate the issue under Binding Operational Directive 26-04.
Active exploitation of the Langflow validate_code endpoint vulnerability was first observed on June 27, 2026. Researchers later recorded more than 220 exploitation attempts from 64 unique source IP addresses before CISA listed the flaw in KEV.
Langflow remediated CVE-2026-0770 in the release-1.10.1 branch by replacing exec()-based validation with compile-only validation. The fix also added a regression test to ensure default arguments are not executed during code validation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceresecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
A public proof-of-concept exploit has been released for **CVE-2026-9198**, a critical remote code execution flaw in **Langflow OSS** that affects versions `1.0.0` through `1.10.0` under default configurations exposing auto-login and code-validation endpoints. According to CSIRT Italia, attackers can chain two weaknesses to obtain **SUPERUSER** privileges and execute arbitrary code on vulnerable instances. The issue has been patched by the vendor, and organizations running exposed Langflow deployments have been urged to update immediately. Additional reporting points to exploit-development and testing activity tied to Langflow, including references to artifacts such as `langflowpoc.py` and `langflowtargets.txt`, alongside infrastructure consistent with staging or proof-of-concept validation. While that material does not confirm victim compromise or attribute activity to a specific threat actor, it indicates that exploit code and targeting resources are circulating publicly, increasing the risk to internet-exposed Langflow systems, including deployments embedded in enterprise AI workflow environments.
Jul 31, 2026