CVE-2026-0772 in Langflow
Summary
by MITRE • 01/23/2026
Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27919.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/25/2026
The CVE-2026-0772 vulnerability represents a critical remote code execution flaw in Langflow's disk cache service that demonstrates a classic deserialization vulnerability pattern. This vulnerability falls under the CWE-502 category, specifically addressing the dangerous practice of deserializing untrusted data without proper validation mechanisms. The flaw exists within the disk cache component where the application fails to properly validate or sanitize user-supplied data before processing it through the deserialization routine. This weakness creates an attack surface where malicious actors can craft specially crafted payloads that, when processed by the vulnerable service, trigger arbitrary code execution. The vulnerability requires authentication to exploit, indicating that it operates within a trusted environment where legitimate users have already established credentials, but this does not prevent the execution of malicious code once access is gained. The attack vector leverages the inherent trust placed in internal data processing mechanisms, where the application assumes that cached data is safe and legitimate.
The technical impact of this vulnerability extends beyond simple code execution to encompass full system compromise when the service account has elevated privileges. When an attacker successfully exploits this vulnerability, they can execute arbitrary commands with the privileges of the service account, potentially leading to complete system takeover if that account has administrative rights. The deserialization process typically involves converting serialized data back into executable objects, and in this case, the lack of input validation allows attackers to inject malicious serialized objects that execute unintended operations when deserialized. This vulnerability aligns with ATT&CK technique T1203 by enabling attackers to gain access to systems through service account compromise, and T1059 for the execution of malicious code through command injection mechanisms. The service account context is particularly concerning as it often operates with broader permissions than regular user accounts, potentially allowing lateral movement throughout the network or access to sensitive data stores that are protected by standard user-level security controls.
The operational impact of CVE-2026-0772 creates significant risk for organizations utilizing Langflow, particularly those with exposed services or those that rely heavily on disk caching functionality for performance optimization. Organizations may experience data breaches, system compromise, and potential regulatory violations if this vulnerability is exploited successfully. The requirement for authentication suggests that this vulnerability is more likely to be exploited by insiders or through credential compromise, but it remains a serious threat as it can be leveraged to escalate privileges and maintain persistent access. Security teams must implement immediate mitigations including patching the affected software, implementing network segmentation to limit access to vulnerable services, and monitoring for unusual deserialization patterns or suspicious cache operations. The vulnerability also highlights the importance of secure coding practices and input validation, particularly when handling serialized data in service-oriented architectures. Organizations should review their cache implementations and ensure that all deserialization operations include proper validation, sanitization, and integrity checking mechanisms to prevent similar vulnerabilities from being introduced in future versions or related components. The ZDI-CAN-27919 reference indicates this vulnerability has been formally recognized by the cybersecurity community and should be prioritized in vulnerability management programs alongside other critical remote code execution threats.