The Cybersecurity and Infrastructure Security Agency (CISA) has ordered U.S. federal agencies to patch a critical remote code execution vulnerability in Langflow, one of the most popular open-source frameworks for building AI agents, after confirming active exploitation in the wild. With a near-maximum CVSS score of 9.8, the flaw lets unauthenticated attackers run code as root with minimal effort.
Langflow is a drag-and-drop visual tool for building and deploying AI-powered agents and workflows, and it has exploded in popularity, passing 150,000 stars on GitHub. That popularity is exactly what makes this flaw so consequential — Langflow instances are widely deployed across individual developer projects, startups, and enterprise AI pipelines alike.
How CVE-2026-0770 Works
The vulnerability lives in how Langflow handles the exec_globals parameter passed to its validate endpoint. According to the researchers at Trend Micro who discovered and reported the flaw, the issue stems from Langflow incorporating a resource from an untrusted control sphere — in plain terms, it trusts input it shouldn’t, letting an attacker execute arbitrary code in the context of the Langflow process itself, with root-level privileges.
Because the flaw requires no authentication and involves low attack complexity, it’s an especially attractive target. Threat intelligence firm KEVIntel first observed exploitation attempts in the wild on June 27, recording more than 220 exploitation attempts from 64 distinct source IP addresses before CISA formally added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026.
CISA’s Deadline and What It Means
Under Binding Operational Directive (BOD) 26-04, U.S. Federal Civilian Executive Branch (FCEB) agencies had a July 24, 2026 remediation deadline in the KEV record, per CISA’s official KEV catalog advisory. CISA’s advisory notes that this type of vulnerability is a frequent attack vector for malicious actors and poses significant risk to the federal enterprise, and that organizations are responsible for evaluating each asset’s internet exposure and complying with the patching guidance.
Notably, CISA added this Langflow flaw to its KEV catalog in the same batch of advisories that included the wp2shell WordPress vulnerabilities we covered earlier this week — a reminder that critical, actively exploited flaws are landing across the software ecosystem in rapid succession right now, not in isolation.
While the CISA directive is legally binding only for federal agencies, the underlying risk applies equally to any organization running an internet-exposed Langflow instance — private companies just don’t face a compliance deadline for it.
A Troubling Detail: This Flaw Isn’t New
Patch information needs to be read with its source date. The GitHub advisory, last updated February 19, 2026, lists versions up to 1.7.3 as affected and no patched version. However, the later CISA KEV record references Langflow 1.9.0 and requires vendor mitigations, exposure assessment and forensic triage under BOD 26-04. The older database field alone does not establish that no fix exists today. Confirm the applicable remediation with the maintainer for your deployment.
This isn’t Langflow’s first appearance in CISA’s KEV catalog either. The platform has been flagged for exploited vulnerabilities multiple times in the past year — including a missing-authentication issue in May 2025, a code injection flaw in March 2026, and an insecure direct object reference bug in July 2026 that CISA separately ordered patched under the same BOD 26-04 authority. That July flaw was notably tied to a credential-harvesting campaign and, in an earlier related Langflow flaw, to JADEPUFFER — one of the first documented cases of what researchers call agentic ransomware, where a human operator deploys an AI agent to run an entire extortion operation autonomously.
That pattern — a widely deployed AI agent framework with a track record of exploited flaws, some tied to autonomous attack tooling — fits into a broader story we’ve been tracking closely, including the recent case of OpenAI’s own models autonomously breaching Hugging Face. As AI infrastructure becomes more embedded in enterprise environments, it’s increasingly becoming both the target and, in some cases, the tool of the attack itself.
How to Secure Your Langflow Deployment
Based on CISA and researcher guidance, here’s what to do if you run Langflow:
- Verify remediation evidence: Inventory the installed version and exposure, then reconcile the dated advisory with CISA’s vendor reference. Record the release or mitigation applied and validate it on each instance. Do not assume that either an old “None” field or a newer version number alone settles the deployment’s security status.
- Restrict internet exposure: Langflow was never designed to be safely exposed directly to the public internet. Place it behind a VPN, firewall, or authentication gateway rather than allowing open access.
- Audit historical traffic to the validate endpoint: Review logs for requests to
/api/v1/validate/codeand similar endpoints for signs of exploitation attempts matching this pattern. - Restrict access to validation functionality: Limit which users and systems can reach Langflow’s code validation features, since that’s the specific mechanism this flaw abuses.
- Rotate credentials if exploitation is suspected: Given this flaw’s ability to grant root-level code execution, treat any suspected compromise as a full credential-rotation event, not a simple patch-and-move-on situation.
Frequently Asked Questions
What is CVE-2026-0770?
CVE-2026-0770 is a critical remote code execution vulnerability in Langflow, an open-source AI agent framework, that lets unauthenticated attackers run arbitrary code as root by exploiting how the platform handles input to its validate endpoint.
Is Langflow safe to use right now?
The dated GitHub advisory lists versions up to 1.7.3 as affected. CISA’s later entry references release 1.9.0. Confirm the applicable vendor remediation and restrict untrusted access; a version number alone does not establish that an instance is secure.
What is CISA’s deadline for patching this flaw?
The KEV entry lists July 24, 2026 as the remediation deadline and points to BOD 26-04 guidance. This is a historical deadline; agencies should follow the applicable exposure and forensic-triage requirements.
How is this related to AI agent security more broadly?
Langflow has repeatedly appeared in CISA’s exploited vulnerabilities catalog, including flaws previously linked to credential-harvesting campaigns and one of the first documented cases of autonomous “agentic ransomware,” reflecting a growing pattern of AI infrastructure being targeted and abused.
Update — October 10, 2026: Replaced the relative deadline with its calendar date and clarified the difference between the February GitHub advisory and the later CISA vendor reference. Both FAQ text and structured block content were updated.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise security, federal AI directives, and the future of IT infrastructure. Follow us for daily updates on how technology is reshaping the corporate landscape.
