CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
Other sources
Langflow execglobals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the execglobals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0770?
The severity of CVE-2026-0770 is considered critical due to its potential for remote code execution.
How do I fix CVE-2026-0770?
To fix CVE-2026-0770, it is recommended to update the Langflow software to the latest secure version provided by the vendor.
What impact does CVE-2026-0770 have?
CVE-2026-0770 allows remote attackers to execute arbitrary code on affected systems, leading to potential full system compromise.
Which software is affected by CVE-2026-0770?
CVE-2026-0770 affects Langflow software that utilizes exec_globals functionality.
Is there a workaround for CVE-2026-0770?
As of now, there are no known workarounds to mitigate CVE-2026-0770, so updating is the recommended action.