Langflow exec_globals inclusion of functionality from untrusted control sphere

Summaryinfo

A vulnerability classified as very critical was found in Langflow. Affected by this vulnerability is the function exec_globals. Such manipulation leads to Remote Code Execution. This vulnerability is referenced as CVE-2026-0770. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Langflow (version unknown) and classified as very critical. Affected by this issue is the function exec_globals. The manipulation with an unknown input leads to a remote code execution vulnerability. Using CWE to declare the problem leads to CWE-829. The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

The advisory is shared for download at zerodayinitiative.com. This vulnerability is handled as CVE-2026-0770. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/21/2026).

The exploit is available at exploit-db.com. It is declared as attacked. This issue was added on 07/21/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 07/24/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (52597). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Langflow

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion