CISA Orders Federal Agencies to Patch Actively Exploited Langflow RCE Flaw
Summary
CISA ordered U.S. federal agencies to patch CVE-2026-0770 in Langflow by Friday. KEVIntel reported active exploitation attempts, including attempts to deploy malware and access AWS credentials and metadata.
Key points
- CVE-2026-0770 lets unauthenticated attackers execute code as root through Langflow’s validate endpoint and its exec_globals parameter.
- KEVIntel reported observing exploitation beginning June 27, with more than 220 attempts from 64 source IPs.
- Observed payloads included attempts to download scripts, deploy malware, and access AWS credentials, environment variables, and container metadata.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by Friday under BOD 26-04.
- KEVIntel advised reviewing requests to /api/v1/validate/code and host activity, restricting access to the validation functionality, and rotating credentials if successful execution cannot be ruled out.
Article Details
- Vulnerability Types
- Remote code execution
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Restrict access to the validation functionality.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterKEVIntel observed command-execution checks during exploitation attempts against Langflow.T1105 · Ingress Tool TransferKEVIntel observed attempts to download second-stage scripts.T1552.001 · Credentials In FilesKEVIntel observed attempts to access credential files.T1552.005 · Cloud Instance Metadata APIKEVIntel observed attempts to access cloud metadata and obtain AWS credentials.T1613 · Container and Resource DiscoveryKEVIntel observed attempts to collect container metadata.
CVE
CVE-2025-3248as exploited in the wild in recent years, including a missing authentication security issue (CVE-2025-3248) in May 2025, a code injection vulnerability (CVE-2026-33017) in March 2026, and an Insecure DirectCVE-2026-0770federal agencies to urgently patch CVE-2026-0770, a critical Langflow flaw that lets unauthenticated attackers achieve root remote code execution.