CVE-2026-0772: (0Day) Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability
Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27919.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0772?
CVE-2026-0772 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-0772?
To fix CVE-2026-0772, update Langflow to the latest version that includes patches for this vulnerability.
What systems are affected by CVE-2026-0772?
CVE-2026-0772 affects installations of Langflow that use disk caching without proper data validation.
Can CVE-2026-0772 lead to data breaches?
Yes, CVE-2026-0772 can lead to data breaches if an attacker exploits it to execute arbitrary code.
What are the signs of an exploitation of CVE-2026-0772?
Signs of exploitation of CVE-2026-0772 may include unexpected application behavior, performance issues, or unauthorized access attempts.