Executive Summary
CVE-2026-0770 is a critical remote code execution vulnerability in Langflow, the open-source Python platform for building and deploying LLM workflows. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning Langflow can be made to load and execute code or functionality sourced from an attacker-controlled location. CISA added this CVE to the Known Exploited Vulnerabilities catalog on July 21, 2026 with a 72-hour federal remediation deadline of July 24, indicating active exploitation is underway. The fix is Langflow v1.9.0.
This is the fourth distinct Langflow CVE to reach CISA’s KEV catalog in 2026, placing Langflow among the most targeted AI infrastructure components currently being exploited in the wild. Organisations running self-hosted Langflow instances, particularly those with internet-exposed management interfaces, should treat this as an emergency patching event.
Affected Versions
All Langflow versions prior to 1.9.0 are affected. The reference in CISA’s advisory points to the v1.9.0 release at https://github.com/langflow-ai/langflow/releases/tag/v1.9.0.
Installations via pip (pip install langflow), Docker, or self-hosted deployments on cloud infrastructure are all affected. Langflow Cloud (the managed version operated by DataStax) should be considered patched via the vendor’s update cadence, but self-hosted instances require manual action.
Vulnerability Details
CWE-829, Inclusion of Functionality from Untrusted Control Sphere, describes a vulnerability where software imports, includes, or dynamically loads code from an external source without verifying that the source is trustworthy. The distinction from direct code injection (CWE-94) is that the loaded functionality may originate from a URL, a file path, a network resource, or any location the attacker can control, rather than being injected inline.
In Langflow’s architecture, this vulnerability class is particularly significant because the platform’s core value proposition involves dynamically loading and executing custom components. Langflow allows users to define Python components that run within the workflow execution environment. The vulnerability in CVE-2026-0770 appears in the component loading mechanism — specifically, a pathway that allows a component definition or dependency to reference code from an untrusted external location without adequate validation of the source or the loaded content.
The practical attack path: an attacker who can reach the Langflow API or web interface (either because it is publicly exposed, or because they have compromised a client network) crafts a request that causes Langflow to load and execute a malicious component or module. The code executes with the privileges of the Langflow process, which in typical deployments runs with the permissions needed to access LLM API keys, database connections, and other credential material stored in the Langflow environment.
This CWE-829 flaw is distinct from:
- CVE-2026-33017 (code injection in the Langflow execution environment — an attacker injects Python code directly via the API)
- CVE-2026-55255 (IDOR allowing cross-tenant access and unauthorised workflow execution)
- CVE-2025-34291 (origin validation bypass enabling RCE via the custom component system)
CVE-2026-0770 specifically involves loading from an external, attacker-controlled source rather than inline injection, which may affect how WAF rules and API gateway controls intercept it.
Exploitation in the Wild
CISA’s July 24 deadline confirms active exploitation. Langflow has been a consistent target for threat actors throughout 2026 due to the combination of factors: sensitive credential material (LLM API keys, cloud provider credentials) accessible from the execution environment, Python execution capabilities that provide a rich post-exploitation environment, and a substantial self-hosted installation base that updates less frequently than managed services.
Prior Langflow exploitation campaigns observed in 2026 have targeted:
- LLMjacking — stealing API keys and compute to run attacker-controlled LLM workloads at victim expense
- Initial access into cloud environments by extracting cloud credentials stored as Langflow environment variables
- Lateral movement via network access from Langflow hosts to adjacent services
CVE-2026-0770 exploitation likely follows similar post-exploitation patterns given that the vulnerability grants code execution in the same environment where these credentials are accessible.
No specific threat actor attribution for CVE-2026-0770 exploitation has been published at time of writing. Given the prior campaign patterns against Langflow, both opportunistic criminal actors (LLMjacking groups) and more targeted threat actors (seeking cloud credential access) are plausible exploiters.
Patch and Remediation
Immediate action: Update Langflow to v1.9.0.
# Via pip
pip install --upgrade langflow==1.9.0
# Verify installed version
langflow --version
# Docker: pull updated image
docker pull langflowai/langflow:1.9.0If patching is not immediately possible:
-
Restrict network access: Remove internet exposure from the Langflow management interface. Langflow instances should not be reachable from the public internet under any circumstances. Place behind a VPN or network segment accessible only from authorised workstations.
-
Disable external component loading: Review Langflow configuration for settings that control dynamic component loading from external sources. Restrict or disable the pathways that allow components to reference external URLs or untrusted file paths.
-
Rotate credentials: Assume any API keys, database passwords, or cloud provider credentials accessible from the Langflow environment may have been compromised. Rotate all credential material associated with your Langflow deployment as a precaution.
-
Audit recent flows: Review Langflow logs for unexpected component loading requests, API calls to unusual external URLs, or flows that were created or modified without authorisation.
Detection
Process monitoring: On the Langflow host, monitor for unexpected outbound network connections, new processes spawned by the Langflow process, or file system modifications outside expected Langflow directories. The auditd daemon on Linux can log these events.
API logging: Langflow’s API request logs should be reviewed for requests containing external URLs in component definitions, particularly URLs pointing to attacker-controlled infrastructure rather than known package repositories.
Credential abuse indicators: Alert on LLM API keys associated with your Langflow deployment being used from unexpected source IPs or making unusual volume requests. LLMjacking activity often shows up as elevated API costs before it is detected as a security incident.
Container security: If running Langflow in Docker or Kubernetes, enable container runtime security (Falco, Sysdig, or equivalent) to detect unexpected process execution, file writes, or network connections from the container.
IOCs: No specific indicators of compromise for CVE-2026-0770 have been released at time of publication. Monitor Langflow’s GitHub security advisories and CISA’s KEV catalog for updated intelligence.