Summary
generated automatically from NVD dataLangflow has a remote code execution flaw in how the validate endpoint handles the exec_globals parameter, caused by inclusion of functionality from an untrusted control sphere (CWE-829). A remote attacker needs no authentication and can run arbitrary code with root privileges on affected installations. The issue is rated CVSS 9.8 (CRITICAL) and is listed in the CISA KEV catalog, meaning it is actively exploited.
NVD description
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-07-24
EPSS · FIRST.org
63.0%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.0 Score
Information
- Published
- 23 janv. 2026
- Updated
- 22 juil. 2026
- Status
- Analyzed
- Source
- zdi-disclosures@trendmicro.com
Affected products
Weaknesses (CWE)
References (2)
- https://www.zerodayinitiative.com/advisories/ZDI-26-036/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0770US Government Resource
Similar CVEs
Other vulnerabilities of type CWE-829
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.