CVE-2026-0770: Langflow — Untrusted Control Sphere RCE

Background

Langflow is an open-source Python platform for building and deploying LLM (large language model) workflows. It is widely used by organisations to create visual AI pipelines that connect language models, APIs, databases, and custom Python components. Self-hosted Langflow instances are common in enterprise AI development environments and cloud infrastructure, and they typically have access to sensitive credential material — LLM API keys, cloud provider credentials, and database connection strings stored as environment variables or in the Langflow configuration.

CVE-2026-0770 is a critical remote code execution vulnerability in Langflow classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). CISA added this CVE to the Known Exploited Vulnerabilities catalog on July 21, 2026, with a 72-hour federal remediation deadline of July 24, indicating active exploitation is underway. The fix is Langflow v1.9.0. This is the fourth distinct Langflow CVE to reach CISA’s KEV catalog in 2026, placing Langflow among the most targeted AI infrastructure components currently being exploited in the wild.

Technical Mechanism

CWE-829: Inclusion of Functionality from Untrusted Control Sphere — this vulnerability class describes software that imports, includes, or dynamically loads code from an external source without verifying that the source is trustworthy. The distinction from direct code injection (CWE-94) is that the loaded functionality may originate from a URL, a file path, a network resource, or any location the attacker can control, rather than being injected inline.

In Langflow’s architecture, this vulnerability class is particularly significant because the platform’s core value proposition involves dynamically loading and executing custom components. Langflow allows users to define Python components that run within the workflow execution environment. The vulnerability in CVE-2026-0770 appears in the component loading mechanism — specifically, a pathway that allows a component definition or dependency to reference code from an untrusted external location without adequate validation of the source or the loaded content.

Attack flow:

1. An attacker who can reach the Langflow API or web interface (because it is publicly exposed, or because they have compromised a client network) crafts a request that references a malicious component or module hosted at an attacker-controlled location.
2. Langflow’s component loading mechanism fetches and loads the external code without adequate source validation.
3. The malicious code executes with the privileges of the Langflow process.
4. The attacker gains code execution in an environment with access to LLM API keys, database connections, and other credential material stored in the Langflow deployment.

This CWE-829 flaw is distinct from other Langflow CVEs:

• CVE-2026-33017 — code injection in the Langflow execution environment (attacker injects Python code directly via the API)
• CVE-2026-55255 — IDOR allowing cross-tenant access and unauthorised workflow execution
• CVE-2025-34291 — origin validation bypass enabling RCE via the custom component system

CVE-2026-0770 specifically involves loading from an external, attacker-controlled source rather than inline injection, which may affect how WAF rules and API gateway controls intercept it.

Real-World Exploitation Evidence

CISA’s July 21, 2026 KEV addition with a July 24 deadline confirms active exploitation. Langflow has been a consistent target for threat actors throughout 2026 due to the combination of factors: sensitive credential material (LLM API keys, cloud provider credentials) accessible from the execution environment, Python execution capabilities that provide a rich post-exploitation environment, and a substantial self-hosted installation base that updates less frequently than managed services.

Prior Langflow exploitation campaigns observed in 2026 have targeted:

• LLMjacking — stealing API keys and compute to run attacker-controlled LLM workloads at victim expense
• Initial access into cloud environments by extracting cloud credentials stored as Langflow environment variables
• Lateral movement via network access from Langflow hosts to adjacent services

CVE-2026-0770 exploitation likely follows similar post-exploitation patterns given that the vulnerability grants code execution in the same environment where these credentials are accessible. No specific threat actor attribution for CVE-2026-0770 exploitation has been published at time of writing. Given the prior campaign patterns against Langflow, both opportunistic criminal actors (LLMjacking groups) and more targeted threat actors (seeking cloud credential access) are plausible exploiters.

Impact Assessment

Successful exploitation of CVE-2026-0770 grants an attacker remote code execution with the privileges of the Langflow process. In typical deployments this means the attacker can:

• Read and exfiltrate all LLM API keys (OpenAI, Anthropic, etc.) configured in the Langflow environment
• Extract cloud provider credentials (AWS, GCP, Azure) stored as environment variables
• Access database connection strings and any other secrets available to the Langflow process
• Execute arbitrary commands on the host system or container
• Modify or delete Langflow workflows, flows, and stored data

The broader impact extends well beyond the Langflow instance itself. LLMjacking — using stolen API keys to run attacker workloads — results in significant unexpected API costs and potential usage violations. Stolen cloud credentials enable lateral movement into the broader cloud environment. For organisations using Langflow as part of production AI pipelines, compromise can affect downstream services and data integrity.

Sector-specific risk is highest for organisations with internet-exposed Langflow management interfaces, particularly those in AI-intensive industries (technology, research, financial services) where LLM workflow tooling is common and where the credential blast radius from a Langflow compromise extends into sensitive production systems.

Affected Versions

All Langflow versions prior to 1.9.0 are affected.

Installations via pip (pip install langflow), Docker, or self-hosted deployments on cloud infrastructure are all affected. Langflow Cloud (the managed version operated by DataStax) should be considered patched via the vendor’s update cadence, but self-hosted instances require manual action.

Remediation Steps

1. Update Langflow to v1.9.0 immediately.

   # Via pip
   pip install --upgrade langflow==1.9.0
   
   # Verify installed version
   langflow --version
   
   # Docker: pull updated image
   docker pull langflowai/langflow:1.9.0

2. If patching is not immediately possible, restrict network access. Remove internet exposure from the Langflow management interface. Langflow instances should not be reachable from the public internet under any circumstances. Place behind a VPN or network segment accessible only from authorised workstations.

3. Disable external component loading. Review Langflow configuration for settings that control dynamic component loading from external sources. Restrict or disable the pathways that allow components to reference external URLs or untrusted file paths.

4. Rotate credentials. Assume any API keys, database passwords, or cloud provider credentials accessible from the Langflow environment may have been compromised. Rotate all credential material associated with your Langflow deployment as a precaution.

5. Audit recent flows. Review Langflow logs for unexpected component loading requests, API calls to unusual external URLs, or flows that were created or modified without authorisation.

Detection Guidance

Process monitoring: On the Langflow host, monitor for unexpected outbound network connections, new processes spawned by the Langflow process, or file system modifications outside expected Langflow directories. The auditd daemon on Linux can log these events.

API logging: Langflow’s API request logs should be reviewed for requests containing external URLs in component definitions, particularly URLs pointing to attacker-controlled infrastructure rather than known package repositories.

Credential abuse indicators: Alert on LLM API keys associated with your Langflow deployment being used from unexpected source IPs or making unusual volume requests. LLMjacking activity often shows up as elevated API costs before it is detected as a security incident.

Container security: If running Langflow in Docker or Kubernetes, enable container runtime security (Falco, Sysdig, or equivalent) to detect unexpected process execution, file writes, or network connections from the container.

IOCs: No specific indicators of compromise for CVE-2026-0770 have been released at time of publication. Monitor Langflow’s GitHub security advisories and CISA’s KEV catalog for updated intelligence.

Timeline

References

• Langflow v1.9.0 Release
• NVD — CVE-2026-0770
• CISA KEV Catalog
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk