CVE-2026-0770High▾ Abyssal⚠ Exploited in the wild0dayPoC available

Langflow affected by Remote Code Execution via validate_code() exec()

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score79/ 100 · Elevated

impact 41.3 · likelihood 12.5 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jan 23, 2026

Updated

Jul 7, 2026

CVSS

—

Vendor

langflow

Product

langflow

CWE

—

Depth score

79 · Elevated

EPSS

63% · p99

Platforms

—

Source

OSV

Vector

—

Exploit availability

Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.

checked 2026-10-27

Exploit-DB

Search Exploit-DB for CVE-2026-0770 ↗

GitHub PoCs

7 public repositories

Metasploit

exploit/multi/http/langflow_rce_cve_2026_0770 ↗

Nuclei

CVE-2026-0770.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 29.

56% → 63%▲ 6.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 278 days

Jan 23, 2026Published
Disclosed via OSV
Jul 7, 2026Record revised
Last analysed / modified upstream
Jul 21, 2026Added to CISA KEV
Federal remediation due Jul 24, 2026
Jul 21, 2026Exploitation in the wild observed
Jul 29, 2026EPSS first tracked
56%
Sep 20, 2026EPSS peak
56% → 64%
Oct 27, 2026Public exploit observed
Exploit-DB · 7 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)

langflow #osv #pip #exploit-available #kev #in-the-wild

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 21, 2026. Federal remediation due Jul 24, 2026. View catalog ↗

Affected

langflow <= 1.7.3

Full technical detail▾

Overview

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Affected packages

langflow <= 1.7.3

Remediation

Refer to the advisory for the patched release.

References

Change history

Field changes observed since this record was first indexed.

Aug 22, 2026EPSS 57% → 63%
Jul 22, 2026EPSS 10% → 55%
Jul 21, 2026Exploitation in the wild observed
Jul 21, 2026Added to CISA KEV

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip#exploit-available#kev#in-the-wild

← Back to feed

CVE-2026-0770High▾ Abyssal⚠ Exploited in the wild0dayPoC available

Langflow affected by Remote Code Execution via validate_code() exec()

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score79/ 100 · Elevated

impact 41.3 · likelihood 12.5 · exploitation 25

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jan 23, 2026

Updated

Jul 7, 2026

CVSS

—

Vendor

langflow

Product

langflow

CWE

—

Depth score

79 · Elevated

EPSS

63% · p99

Platforms

—

Source

OSV

Vector

—

Exploit availability

Public exploit / PoC code seen in 4 sources. Availability, not in-the-wild use.

checked 2026-10-27

Exploit-DB

Search Exploit-DB for CVE-2026-0770 ↗

GitHub PoCs

7 public repositories

Metasploit

exploit/multi/http/langflow_rce_cve_2026_0770 ↗

Nuclei

CVE-2026-0770.yaml ↗

EPSS history

Exploit-prediction probability, daily snapshots since Jul 29.

56% → 63%▲ 6.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

7 events · 278 days

Jan 23, 2026Published
Disclosed via OSV
Jul 7, 2026Record revised
Last analysed / modified upstream
Jul 21, 2026Added to CISA KEV
Federal remediation due Jul 24, 2026
Jul 21, 2026Exploitation in the wild observed
Jul 29, 2026EPSS first tracked
56%
Sep 20, 2026EPSS peak
56% → 64%
Oct 27, 2026Public exploit observed
Exploit-DB · 7 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)

langflow #osv #pip #exploit-available #kev #in-the-wild

CISA KEVKnown Exploited Vulnerability

Added to the CISA catalog on Jul 21, 2026. Federal remediation due Jul 24, 2026. View catalog ↗

Affected

langflow <= 1.7.3

Full technical detail▾

Overview

Affected packages

langflow <= 1.7.3

Remediation

Refer to the advisory for the patched release.

References

Change history

Field changes observed since this record was first indexed.

Aug 22, 2026EPSS 57% → 63%
Jul 22, 2026EPSS 10% → 55%
Jul 21, 2026Exploitation in the wild observed
Jul 21, 2026Added to CISA KEV

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip#exploit-available#kev#in-the-wild