What happened
CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on 2026-07-21, confirming in-the-wild exploitation of this critical (CVSS 9.8) unauthenticated RCE in Langflow, a widely-used open-source visual builder for LLM/agent applications. A public PoC and nuclei detection template exist.
Why it matters
Langflow is a widely-deployed low-code framework for building LLM and agentic applications; an unauthenticated RCE with confirmed active exploitation gives attackers direct code execution on any exposed Langflow instance, and this same vulnerability class (Langflow RCE) was also the entry point used by the JadePuffer/ENCFORGE ransomware campaign against AI infrastructure reported the same week.
Attack vector
The `validate_code()` function in Langflow's validate endpoint executes user-supplied Python code via unsandboxed `exec()`, with the `exec_globals` parameter allowing inclusion of functionality from an untrusted control sphere. No authentication is required; a public PoC demonstrates full remote command execution as root.
Affected systems
Langflow (all versions prior to fix; validate endpoint / lfx custom validate.py)
Mitigation
Upgrade to Langflow v1.9.0 or later per vendor release notes; CISA KEV entry lists federal due date 2026-07-24.