CISA Orders Urgent Patching of Actively Exploited Langflow RCE Vulnerability
CISA has mandated federal agencies to patch CVE-2026-0770, a critical RCE flaw in the Langflow AI agent framework, which is being actively exploited in the wild.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, compelling federal agencies to immediately address a critical remote code execution (RCE) vulnerability affecting the Langflow open-source framework. The flaw, identified as CVE-2026-0770, is currently being actively exploited by threat actors, posing a significant risk to government systems.
Discovered by researchers at Trend Micro, the vulnerability resides in how Langflow handles the exec_globals parameter within its validate endpoint. This oversight allows unauthenticated attackers to execute arbitrary code with root privileges through low-complexity attacks. The researchers noted that the issue stems from the framework's inclusion of resources from an untrusted control sphere, creating a pathway for malicious code injection.
Vulnerability intelligence firm KEVIntel first detected exploitation attempts for CVE-2026-0770 on June 27, recording over 220 attempts from 64 distinct IP addresses before its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. This rapid exploitation highlights the urgency of the situation and the potential for widespread compromise.
Ryan Dewhurst, founder of KEVIntel, revealed that the malicious activity observed extends beyond simple vulnerability scanning. Attackers have been observed deploying malware, attempting to steal AWS credentials, extract environment variables, and access container metadata. "Most activity involved command-execution checks or system reconnaissance," Dewhurst stated, emphasizing that some attacks also aimed to download further malicious scripts.
In response to the escalating threat, CISA has added CVE-2026-0770 to its KEV catalog and issued Binding Operational Directive (BOD) 26-04. This directive mandates that U.S. Federal Civilian Executive Branch (FCEB) agencies must secure their systems by Friday, July 26, 2026. CISA stressed that such vulnerabilities are frequent attack vectors and pose substantial risks to the federal enterprise, underscoring the responsibility of stakeholders to assess their exposure and adhere to patching guidelines.
This is not the first time Langflow has been targeted; CISA has previously flagged other actively exploited vulnerabilities in the framework. These include a missing authentication flaw (CVE-2025-3248) in May 2025, a code injection vulnerability (CVE-2026-33017) in March 2026, and an Insecure Direct Object Reference (IDOR) flaw (CVE-2026-55255) earlier this month. Notably, CVE-2025-3248 was linked to ransomware attacks by the JadePuffer gang, which used it to exfiltrate Langflow PostgreSQL databases.
Organizations utilizing Langflow are strongly advised to investigate their logs for suspicious activity on the /api/v1/validate/code endpoint, review host-level activity, and restrict access to the validation functionality. Furthermore, any exposed credentials should be rotated immediately, especially if successful exploitation cannot be definitively ruled out. The ongoing exploitation of AI-related tools like Langflow underscores a growing trend of attackers targeting the infrastructure underpinning artificial intelligence development and deployment.