CISA orders urgent action on actively exploited Langflow RCE flaw
CISA orders U.S. federal agencies to urgently patch CVE-2026-0770, a critical Langflow RCE flaw already exploited in the wild to steal cloud credentials and deploy malware.
Intelligence analysis by Llama
CISA added CVE-2026-0770, a critical unauthenticated RCE in the Langflow AI agent framework, to its KEV catalog after researchers observed 220+ exploitation attempts from 64 IPs. Attackers are stealing AWS credentials and deploying malware. Federal agencies must patch by Friday under BOD 26-04.
Langflow is a tool people use to build AI helpers. Someone found a hole in it that lets bad guys run any code they want on computers using Langflow. The U.S. government says fix it now because attackers are already sneaking in to steal passwords and plant malware.
Analysis
A Repeat Target for Attackers
Langflow is starting to look like a familiar name on CISA's Known Exploited Vulnerabilities catalog. CVE-2026-0770 is at least the fourth Langflow flaw the agency has flagged as actively exploited in roughly fourteen months, following a missing-authentication bug (CVE-2025-3248) in May 2025, a code injection issue (CVE-2026-33017) in March 2026, and an Insecure Direct Object Reference (CVE-2026-55255) earlier this month. CISA has separately confirmed that CVE-2025-3248 is being abused by the JadePuffer ransomware gang to dump Langflow's PostgreSQL databases, a reminder that the framework sits close to sensitive training data and operational pipelines. The recurrence suggests a structural problem rather than a one-off slip, and defenders who standardized on Langflow for AI agent workflows should treat the entire surface as a chronic exposure.
The Mechanics of a One-Request Takeover
The new flaw lives in the handling of the exec_globals parameter passed to Langflow's /api/v1/validate/code endpoint. According to Trend Micro researchers who discovered and reported the bug, the inclusion of a resource from an untrusted control sphere lets an unauthenticated attacker execute code in the context of root. The low attack complexity and lack of authentication requirement mean that any internet-exposed Langflow instance is a viable target, and KEVIntel founder Ryan Dewhurst told BleepingComputer that the malicious payloads his team captured go well beyond simple probing. Attackers were observed running system reconnaissance, downloading second-stage scripts, and explicitly reaching for AWS credentials, environment variables, and container metadata. In cloud-native deployments, those artifacts are often the keys to the rest of the estate, turning a single Langflow compromise into a potential pivot across an entire AWS organization.
What the Federal Deadline Actually Signals
By adding CVE-2026-0770 to the KEV catalog, CISA triggered Binding Operational Directive 26-04, giving Federal Civilian Executive Branch agencies until Friday to secure their systems. The agency warned that this class of vulnerability is a frequent attack vector and told stakeholders to evaluate each asset's internet exposure against the patching guidelines. Beyond the immediate federal action, the KEV listing functions as a public advisory: any private-sector organization running Langflow now has both the indicator of compromise and a clear mandate to investigate historical requests against the validate endpoint, rotate potentially exposed credentials, and restrict access to the validation functionality. The combined weight of the KEV entry, the public exploitation timeline, and the credential-theft tradecraft means defenders cannot afford to treat this as a routine patch cycle.
Key points
- CISA added CVE-2026-0770, a critical unauthenticated RCE in Langflow, to its KEV catalog and gave federal agencies until Friday to patch under BOD 26-04
- The flaw in the validate endpoint's exec_globals parameter allows root-level code execution with no authentication required
- KEVIntel recorded more than 220 exploitation attempts from 64 unique IPs since June 27, including activity designed to steal AWS credentials and deploy malware
- Attack payloads went beyond reconnaissance, attempting to read environment variables, cloud metadata, and credential files
- CVE-2026-0770 is at least the fourth Langflow vulnerability the agency has flagged as actively exploited in roughly fourteen months
FCEB agencies that meet the Friday deadline will close the immediate attack window, and the public KEV listing gives private-sector operators a clear signal to audit their Langflow instances and rotate credentials. Continued coordinated disclosure through Trend Micro, KEVIntel, and CISA demonstrates a working pipeline for surfacing AI infrastructure flaws before they spread further.
With 220+ exploitation attempts already recorded and credential theft observed, attackers may already hold AWS keys and container metadata that can be exploited long after the patch lands. The fourth Langflow CVE added to KEV in roughly fourteen months suggests a pattern of recurring flaws that defenders will struggle to keep up with, and any organization that delayed rotating secrets now faces an extended exposure window.
