Loading vulnerability…
Unauthenticated Python Code Execution in Langflow Code Validator
CVE-2026-0768 is a code-injection vulnerability in the code validator of Langflow's custom component editor. The validate endpoint executes the user-controlled code parameter through Python's exec() without adequate validation or isolation. Remote attackers can submit crafted Python code without authentication when the endpoint is anonymously accessible. Execution occurs with the Langflow service's privileges, including root where the service runs as root. Langflow versions through 1.4.2 are reported affected. The vulnerability was publicly disclosed on January 9, 2026, and active exploitation has been observed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the confidentiality, integrity, and availability of the affected Langflow environment. Attackers can execute commands, read or modify accessible files, retrieve application secrets and cloud or model-provider credentials, and establish persistence. Root-run deployments expose the full privileges of the affected host or container context; container escape is not established by this vulnerability alone. Observed exploitation includes reconnaissance and credential harvesting. Stolen credentials and reachable internal services can enable further compromise and lateral movement.
If you can’t patch tonight, do this now.
Remove direct internet exposure and restrict Langflow access to trusted users and networks through firewall rules, allowlists, or a VPN. Disable or separately gate the vulnerable validation functionality, require explicit authentication, and disable anonymous auto-login where enabled. Authentication and network restrictions reduce exposure but do not correct the unsafe code-execution behavior. Run Langflow without root privileges and apply containment and network segmentation. Monitor validation requests, unexpected Python or shell execution, access to secrets and environment variables, and unusual outbound connections; investigate suspected exploitation as an incident.
Patch, then assume compromise.
Urgently install the latest vendor-provided Langflow security updates after appropriate testing, confirming that the selected release addresses CVE-2026-0768. A consistently verified minimum fixed version is not available in the supplied information. Investigate previously exposed instances for compromise and remove unauthorized processes, persistence, and configuration changes. Rotate potentially exposed Langflow secrets, cloud credentials, model-provider API keys, SSH keys, and other accessible credentials. Updating the software does not reverse an existing compromise.
2 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
83 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.