Langflow CVE-2026-0770 Enables Unauthenticated RCE Through Code Validation Endpoint

Summary

CVE-2026-0770 lets unauthenticated attackers execute code through Langflow’s /api/v1/validate/code endpoint because validation used Python exec(). The article reports active exploitation and advises upgrading, investigating exposed instances, and rotating credentials.

Key points

The article reports that an unauthenticated POST to Langflow’s /api/v1/validate/code endpoint can trigger remote code execution on vulnerable instances.
The root cause is Python exec() running user-supplied function definitions during validation; default-argument expressions and decorators can execute before a function is called.
Langflow versions 0.0.31 through 1.7.3 are identified as affected; the article says the fix replaces execution with compile-only validation in the release-1.10.1 branch.
The article reports exploitation observed from June 27, 2026, with more than 220 attempts from 64 source IP addresses before CISA added the CVE to its KEV Catalog on July 21.
Reported activity includes system reconnaissance, attempts to obtain cloud credentials and environment variables, and downloading second-stage payloads. No single threat actor is publicly attributed.
The article demonstrates the flaw in a controlled lab and describes how crafted function definitions can execute operating-system commands and read files.
Recommended response includes patching, investigating exposed instances and historical requests, rotating potentially exposed credentials, and restricting network access.

Article Details

Attack Vectors: Unauthenticated POST requests to Langflow's /api/v1/validate/code endpoint exploit CVE-2026-0770 in versions 0.0.31 through 1.7.3.
Crafted Python function definitions trigger execution during validation because default-argument expressions and decorators are evaluated when the function is defined and the vulnerable code passes it to exec().
The resulting code execution can run Python and operating-system commands with the privileges of the Langflow process; the article reports installations running as root.
Reported exploitation activity included reconnaissance commands such as id, whoami, and env; attempts to access AWS credentials, environment variables, and container metadata; and downloads of second-stage scripts.
The article describes post-exploitation actions including installing cryptocurrency miners, adding SSH keys or cron jobs where permitted, and scanning internal cloud networks.
Defensive Notes: Upgrade affected Langflow deployments to a fixed release; the article identifies the release-1.10.1 branch and later as fixed.
Treat internet-facing, unpatched deployments as potentially compromised. Investigate historical requests to /api/v1/validate/code and review application, proxy, container, and cloud audit logs.
Rotate potentially exposed cloud credentials, API keys, database credentials, and Kubernetes service-account tokens; review cloud accounts for unauthorized activity.
Rebuild confirmed-compromised containers or virtual machines from a known-good image and backup, and check for persistence before restoring.
Restrict public network access, enforce authentication, and block or rate-limit POST requests to the validation endpoint if it is not required.
Run Langflow as a non-root user, minimize container capabilities and IAM permissions, and restrict unnecessary access to cloud metadata services.
Monitor for unexpected process execution, metadata access, file reads, and outbound connections; the article recommends runtime tools such as Falco or Sysdig.