Loading vulnerability…
Unauthenticated remote code execution in Langflow code validation
CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow's code-validation functionality. The vulnerable validate_code() implementation compiles attacker-supplied Python function definitions and executes them using exec(), with exec_globals constructed from a copy of application globals. Default-argument expressions and decorators execute when the function definition is evaluated, allowing malicious code to run during validation without calling the submitted function. The execution context exposes Python built-ins, imported modules, and application globals without sandbox restrictions. Langflow versions 0.0.31 through 1.7.3 are reported as affected, including version 1.4.2. Successful exploitation executes code with the Langflow process's privileges, potentially as root. Active exploitation has been reported since June 27, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can execute arbitrary Python code and operating-system commands with the privileges of the Langflow process. Root-running deployments can suffer root-context compromise; non-root deployments remain constrained by their runtime permissions. Accessible application secrets, environment variables, cloud credentials, database credentials, and Kubernetes service-account tokens can be exposed. Exploitation can support malware deployment, persistence, and internal reconnaissance. Stolen credentials may enable cloud or Kubernetes account takeover, data exfiltration, and lateral movement. Container escape is not established by this vulnerability alone and additionally depends on exposed mounts or elevated container privileges.
If you can’t patch tonight, do this now.
Restrict or disable access to the code-validation endpoint using network ACLs, reverse-proxy allowlists, or an authentication gateway. Remove public exposure, enforce authentication, and disable anonymous auto-login where enabled. Run Langflow as a non-root user, drop unnecessary container capabilities, apply least-privilege cloud permissions, and restrict access to cloud metadata services. Monitor validation requests, process execution, unexpected outbound connections, and cloud credential use. These controls reduce exposure or consequences but do not replace the validation fix.
Patch, then assume compromise.
Upgrade to Langflow 1.10.1 or later, identified as containing the fix, or apply the official compile-only validation patch. The fix removes execution of submitted function definitions during validation and adds regression coverage for default-argument execution. Investigate previously exposed vulnerable deployments for compromise, review historical validation requests and host activity, and rotate potentially exposed application, cloud, database, signing, and Kubernetes credentials. Rebuild confirmed compromised containers or virtual machines from patched images and known-good configurations; application patching alone does not remove existing persistence.
6 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit; 2 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.