{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/langflow-1.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-0770"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["langflow 1.3.0","langflow 1.2.0","Langflow \u003c v1.9.0"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","webapps","langflow"],"_cs_type":"advisory","_cs_vendors":["langflow"],"content_html":"\u003cp\u003eA remote code execution (RCE) vulnerability exists in Langflow version 1.3.0, tracked as CVE-2026-0770. This flaw stems from the inclusion of functionality from an untrusted control sphere within the \u003ccode\u003eexec_globals\u003c/code\u003e parameter located at the \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint. The vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges on affected systems. Exploit-DB has published a working exploit (EDB-52597) for this vulnerability, which exacerbates the risk for organizations using unpatched instances of Langflow. Version 1.2.0 is also affected.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker sends an HTTP GET request to \u003ccode\u003e/api/v1/auto_login\u003c/code\u003e to obtain an access token.\u003c/li\u003e\n\u003cli\u003eThe server responds with a JSON object containing an \u003ccode\u003eaccess_token\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request to \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe attacker sets the \u003ccode\u003eAuthorization\u003c/code\u003e header with a \u003ccode\u003eBearare {access_token}\u003c/code\u003e string.\u003c/li\u003e\n\u003cli\u003eThe request body contains a JSON object with a \u003ccode\u003ecode\u003c/code\u003e parameter. This \u003ccode\u003ecode\u003c/code\u003e parameter contains a Python script that leverages the \u003ccode\u003esubprocess\u003c/code\u003e module to execute arbitrary commands.\u003c/li\u003e\n\u003cli\u003eThe Python script within the \u003ccode\u003ecode\u003c/code\u003e parameter utilizes \u003ccode\u003e__import__('subprocess').run('%s', shell=True, capture_output=True, text=True)\u003c/code\u003e to execute the attacker-controlled command.\u003c/li\u003e\n\u003cli\u003eThe server executes the attacker-supplied command with root privileges.\u003c/li\u003e\n\u003cli\u003eThe output of the command is returned to the attacker via the API response, confirming code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code with root privileges on the Langflow server. This can lead to complete system compromise, data theft, denial of service, or further lateral movement within the network. Given the nature of Langflow as a low-code framework designed for building flows with Large Language Models, such a compromise could lead to the exposure of sensitive LLM configurations, API keys, and data used within these flows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch or upgrade to a secure version of Langflow to remediate CVE-2026-0770.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Langflow RCE via Validate Endpoint\u003c/code\u003e to detect exploitation attempts in web server logs.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unusual POST requests to the \u003ccode\u003e/api/v1/validate/code\u003c/code\u003e endpoint containing shell metacharacters in the \u003ccode\u003ecode\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T15:00:09Z","date_published":"2026-05-29T08:21:41Z","id":"https://feed.craftedsignal.io/briefs/2026-05-langflow-rce/","summary":"Langflow 1.3.0 contains a remote code execution vulnerability (CVE-2026-0770) due to untrusted input in the exec_globals parameter at the validate endpoint, allowing remote attackers to execute arbitrary code as root without authentication, as demonstrated by a public exploit.","title":"Langflow 1.3.0 Remote Code Execution Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-langflow-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Langflow 1.2.0","version":"https://jsonfeed.org/version/1.1"}