CISA Orders Emergency Patch for Critical Langflow AI Framework Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. federal agencies to patch a critical remote code execution vulnerability in Langflow, one of the most popular open-source frameworks for building AI agents, after confirming active exploitation in the wild. With a near-maximum CVSS score of 9.8, the flaw lets unauthenticated attackers run code as root with minimal effort.

Langflow is a drag-and-drop visual tool for building and deploying AI-powered agents and workflows, and it has exploded in popularity, passing 150,000 stars on GitHub. That popularity is exactly what makes this flaw so consequential — Langflow instances are widely deployed across individual developer projects, startups, and enterprise AI pipelines alike.

How CVE-2026-0770 Works

The vulnerability lives in how Langflow handles the exec_globals parameter passed to its validate endpoint. According to the researchers at Trend Micro who discovered and reported the flaw, the issue stems from Langflow incorporating a resource from an untrusted control sphere — in plain terms, it trusts input it shouldn’t, letting an attacker execute arbitrary code in the context of the Langflow process itself, with root-level privileges.

Because the flaw requires no authentication and involves low attack complexity, it’s an especially attractive target. Threat intelligence firm KEVIntel first observed exploitation attempts in the wild on June 27, recording more than 220 exploitation attempts from 64 distinct source IP addresses before CISA formally added the flaw to its Known Exploited Vulnerabilities (KEV) catalog this week.

CISA’s Deadline and What It Means

Under Binding Operational Directive (BOD) 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to secure affected systems by Friday, per CISA’s official KEV catalog advisory. CISA’s advisory notes that this type of vulnerability is a frequent attack vector for malicious actors and poses significant risk to the federal enterprise, and that organizations are responsible for evaluating each asset’s internet exposure and complying with the patching guidance.

Notably, CISA added this Langflow flaw to its KEV catalog in the same batch of advisories that included the wp2shell WordPress vulnerabilities we covered earlier this week — a reminder that critical, actively exploited flaws are landing across the software ecosystem in rapid succession right now, not in isolation.

While the CISA directive is legally binding only for federal agencies, the underlying risk applies equally to any organization running an internet-exposed Langflow instance — private companies just don’t face a compliance deadline for it.

A Troubling Detail: This Flaw Isn’t New

What makes this case particularly concerning is the timeline. The vulnerability was publicly disclosed by the Zero Day Initiative more than six months ago, and reported to Langflow’s maintainers even earlier — in July of last year. Despite that lead time, the official fix status on the vulnerability’s GitHub advisory still reads “None” as of this writing, even though the current Langflow release has moved on to version 1.10.2. Affected versions are 1.7.3 and earlier.

This isn’t Langflow’s first appearance in CISA’s KEV catalog either. The platform has been flagged for exploited vulnerabilities multiple times in the past year — including a missing-authentication issue in May 2025, a code injection flaw in March 2026, and an insecure direct object reference bug in July 2026 that CISA separately ordered patched under the same BOD 26-04 authority. That July flaw was notably tied to a credential-harvesting campaign and, in an earlier related Langflow flaw, to JADEPUFFER — one of the first documented cases of what researchers call agentic ransomware, where a human operator deploys an AI agent to run an entire extortion operation autonomously.

That pattern — a widely deployed AI agent framework with a track record of exploited flaws, some tied to autonomous attack tooling — fits into a broader story we’ve been tracking closely, including the recent case of OpenAI’s own models autonomously breaching Hugging Face. As AI infrastructure becomes more embedded in enterprise environments, it’s increasingly becoming both the target and, in some cases, the tool of the attack itself.

How to Secure Your Langflow Deployment

Based on CISA and researcher guidance, here’s what to do if you run Langflow:

1. Check your version immediately: If you’re running Langflow 1.7.3 or earlier, you are affected. Since an official fix status still shows “None,” upgrading alone may not fully resolve the issue — treat any internet-facing instance as high risk.
2. Restrict internet exposure: Langflow was never designed to be safely exposed directly to the public internet. Place it behind a VPN, firewall, or authentication gateway rather than allowing open access.
3. Audit historical traffic to the validate endpoint: Review logs for requests to /api/v1/validate/code and similar endpoints for signs of exploitation attempts matching this pattern.
4. Restrict access to validation functionality: Limit which users and systems can reach Langflow’s code validation features, since that’s the specific mechanism this flaw abuses.
5. Rotate credentials if exploitation is suspected: Given this flaw’s ability to grant root-level code execution, treat any suspected compromise as a full credential-rotation event, not a simple patch-and-move-on situation.

Frequently Asked Questions

Reported by CyberUpdates365 Desk

Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.