CVE-2026-0770 Exploited in the Wild: Langflow RCE Added to CISA KEV

KEVIntel first observed remote code execution attempts against Langflow’s code-validation endpoint on 27 June 2026, 24 days before CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog.

Between 27 June and 21 July, KEVIntel sensors retained 137 exploitation attempts from 46 unique source IP addresses. The activity included command-execution checks, system reconnaissance, malware downloaders and attempts to access environment variables, cloud metadata and credentials.

All 137 requests targeted:

POST /api/v1/validate/code
Content-Type: application/json

The dataset includes payloads matching public exploit tooling associated with both CVE-2025-3248 and CVE-2026-0770, alongside generic Python execution payloads that cannot be attributed to either vulnerability from the request alone.

CVE-2025-3248 and CVE-2026-0770 are separate Langflow vulnerabilities, but they affect closely related code-validation functionality and produce highly similar network traffic.

Key findings

• KEVIntel first observed Langflow code-execution attempts on 27 June 2026.
• CISA added CVE-2026-0770 to its KEV catalog on 21 July 2026.
• KEVIntel retained 137 attempts from 46 unique source IP addresses.
• Source IP addresses were geolocated to 17 countries.
• Seventy-five of the 137 events occurred during the final seven days.
• Every retained request targeted POST /api/v1/validate/code.
• Payloads included command-execution checks, malware downloaders and credential-access attempts.
• Some payloads matched public CVE-2025-3248 tooling.
• Others matched the public CVE-2026-0770 proof-of-concept family.
• A substantial portion used generic RCE techniques that cannot be assigned to either CVE from request data alone.
• ProjectDiscovery included a CVE-2026-0770 Nuclei template in Nuclei Templates 10.4.0 on 16 March 2026.

These observations represent exploitation attempts received by KEVIntel sensors. They do not, by themselves, confirm the compromise of unrelated production systems.

CISA adds CVE-2026-0770 to KEV

On 21 July 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog:

CVE	Product	Vulnerability
CVE-2021-27137	DD-WRT	Stack-based buffer overflow
CVE-2026-0770	Langflow	Inclusion of functionality from an untrusted control sphere
CVE-2026-63030	WordPress Core	Interpretation conflict
CVE-2026-60137	WordPress Core	SQL injection

CISA assigned CVE-2026-0770 a federal remediation deadline of 24 July 2026.

This article focuses on CVE-2026-0770 and the overlapping Langflow exploitation traffic observed by KEVIntel.

What is CVE-2026-0770?

CVE-2026-0770 is a remote code execution vulnerability in Langflow, an open-source platform used to build and operate AI and large language model workflows.

The vulnerability affects Langflow’s code-validation functionality. Attacker-controlled Python can reach unsafe execution logic involving exec_globals, allowing code to run in the context of the Langflow process.

The Zero Day Initiative assigned the issue a CVSS score of 9.8 and documented Langflow 1.4.2 as affected. Actual execution privileges depend on how Langflow is deployed and which account or container user runs the application.

The request format observed by KEVIntel was:

POST /api/v1/validate/code
Content-Type: application/json

The submitted JSON contained a Python code property:

{
  "code": "attacker-controlled Python code"
}

How the code-execution techniques work

Langflow’s validation functionality parses submitted Python and processes function definitions.

Python evaluates several parts of a function at definition time. An attacker can place executable expressions in these locations, causing code to run even if the submitted function is never called.

Two techniques appeared repeatedly in KEVIntel telemetry.

Function decorators

Python evaluates decorators as it defines a function:

@exec("attacker-controlled expression")
def function():
    pass

In observed payloads, the expression frequently launched a command and raised an exception containing the command output.

Default function arguments

Python also evaluates default arguments when defining a function:

def function(value=exec("attacker-controlled expression")):
    pass

This provides another way to execute code during validation.

Some payloads used a generator’s .throw() method to raise an exception containing command output:

(lambda result:
    (_ for _ in ()).throw(Exception(result))
)(command_result)

Returning command output through an exception allows the sender to receive results in the HTTP response without relying on a separate callback channel.

KEVIntel exploitation telemetry

KEVIntel retained 137 Langflow code-execution attempts between 27 June and 21 July 2026.

Metric	Observed value
Exploitation attempts	137
Unique source IP addresses	46
KEVIntel sensors	7
Source countries	17
Events during final seven days	75
Source IPs during final seven days	20
Distinct request paths	1
First observed	27 June 2026
Last date included	21 July 2026

All retained requests targeted:

/api/v1/validate/code

The endpoint is specific to Langflow’s code-validation functionality, but it is not specific to one CVE. Both CVE-2025-3248 and CVE-2026-0770 are associated with the same route and similar Python execution primitives.

The requests therefore provide high-confidence evidence of attempted exploitation of Langflow’s validation functionality. Endpoint and payload data alone do not establish which vulnerable Langflow version the sender expected to encounter.

Activity increased before the CISA KEV addition

Seventy-five of the 137 retained events occurred between 15 and 21 July.

That represents 54.7% of the total activity during a seven-day period at the end of the 25-day observation window.

The average during those final seven days was approximately 10.7 events per day, compared with approximately 3.4 events per day across the preceding 18 days.

The data shows that activity was concentrated near the end of the observation period. It does not necessarily indicate a smooth day-by-day increase.

Payload families observed

The payloads can be divided into three attribution categories:

1. Payloads resembling public CVE-2025-3248 tooling
2. Payloads resembling public CVE-2026-0770 tooling
3. Generic Langflow RCE payloads that do not reliably identify either CVE

The syntax can identify a likely public exploit or scanner family. It does not prove which CVE the sender intended to exploit or which Langflow version was expected at the target.

1. @exec(...) decorator payloads

A significant portion of the observed traffic used an @exec(...) decorator.

A simplified version is:

@exec("raise Exception(command_output)")
def function():
    pass

The public CVE-2025-3248 Nuclei template uses this general technique to execute cat /etc/passwd through /api/v1/validate/code.

Observed commands included:

cat /etc/passwd
id
whoami
env

Reading /etc/passwd was the largest individual payload fingerprint, appearing in 27 retained events.

The id and whoami commands were used to determine the account and privilege context of the Langflow process. The env command attempted to expose environment variables that could contain application or service credentials.

These requests are consistent with the public CVE-2025-3248 Nuclei family. The payload style is not exclusive to that vulnerability.

2. Generator .throw() payloads

KEVIntel also observed requests using a function default argument and generator .throw() technique.

A simplified representation is:

def exploit(
    result=run_command()
):
    pass

The command result is passed into a generator that raises an exception:

(_ for _ in ()).throw(Exception(result))

This pattern appears in public CVE-2026-0770 proof-of-concept material and the corresponding ProjectDiscovery template.

Observed variants executed:

cat /etc/passwd
id

Other variants attempted to download and execute second-stage shell scripts.

These requests are consistent with the public CVE-2026-0770 tooling family. They do not prove that a specific CVE-2026-0770-affected version was present at the intended target.

3. Generic Python execution payloads

A large portion of the traffic used generic primitives such as:

def run():
    import os
    return os.popen("id").read()

Other requests used:

exec()
subprocess
os.popen()
os.system()
check_output()

These payloads demonstrate an attempt to exercise Langflow’s Python execution path, but they do not contain a reliable CVE-specific fingerprint.

Some may execute code without returning the result. Others may fail depending on the Langflow version and how the submitted code is processed.

Their presence supports classification as attempted exploitation, but not definitive attribution to CVE-2025-3248 or CVE-2026-0770.

Same path, different vulnerabilities

CVE-2025-3248 and CVE-2026-0770 are separate CVE records.

Their exploitation traffic nevertheless overlaps substantially.

Detail	CVE-2025-3248	CVE-2026-0770
Product	Langflow	Langflow
Associated endpoint	POST /api/v1/validate/code	POST /api/v1/validate/code
Core issue	Missing access control combined with unsafe code validation	Unsafe processing involving exec_globals
Documented affected range	Versions before 1.3.0	Later builds, including 1.4.2
Documented remediation	Langflow 1.3.0 addressed CVE-2025-3248	Public fixed-version guidance remains unclear
Example public tooling fingerprint	@exec(...) decorator	Default argument and generator .throw()

CVE-2025-3248 affected Langflow versions before 1.3.0. The documented fix for that vulnerability was released in Langflow 1.3.0.

CVE-2026-0770 was subsequently documented against a later Langflow build, including version 1.4.2, and concerns a separately identified issue involving exec_globals.

Updating to Langflow 1.3.0 addressed CVE-2025-3248. It should not be assumed to address CVE-2026-0770.

Similarly, the presence of the same endpoint in both exploit families does not mean the vulnerabilities are duplicates.

Malware download and execution attempts

KEVIntel observed multiple payloads intended to download and run shell scripts.

One cluster used the User-Agent:

Go-http-client/1.1

It attempted to retrieve a script named:

kla.sh

Fourteen retained events were associated with this pattern.

Other payloads referenced:

wget.sh
a7891.sh

The commands generally attempted to:

1. Change to /tmp or /var/tmp
2. Download a remote script with wget or curl
3. Make it executable where required
4. Execute it with sh
5. Suppress output or continue in the background

Payload-hosting infrastructure referenced in the requests included:

94.154.43[.]10
104.238.34[.]222
91.92.40[.]118
103.79.185[.]121

These addresses appeared inside attacker-supplied payloads. Their presence does not establish ownership, attribution or continued malicious use.

The requests show an intention to move beyond vulnerability checking and execute a second-stage payload. They do not, by themselves, prove that malware was successfully installed on an external system.

Credential and cloud metadata access attempts

Three retained requests used curl/8.5.0 and contained code intended to locate credentials and secrets.

The payloads attempted to:

• Enumerate process environment variables
• Locate .env files
• Search for AWS credential files
• Read AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
• Contact the ECS task-role metadata service at 169.254.170.2
• Search common Langflow paths for application secrets

Langflow deployments may have access to:

• LLM provider API keys
• Cloud credentials
• Vector database credentials
• Database connection strings
• Application secrets
• Internal APIs
• External automation services

This activity shows that some senders were attempting post-exploitation credential access rather than only checking whether commands could be executed.

The telemetry does not confirm that valid credentials were obtained.

Attacker intent

Intent	Examples	Assessment
RCE confirmation	id, whoami, arithmetic checks	Majority of observed activity
System reconnaissance	/etc/passwd, hostname, environment variables	Frequent
Public PoC or scanner replay	@exec(...), generator .throw()	Material portion
Malware execution attempts	kla.sh, wget.sh, a7891.sh	Multiple clusters
Credential-access attempts	ECS metadata, .env, AWS credential files	Low volume, potentially high impact
Mislabelled or ambiguous scanning	CVE-2025-3248-VULN marker	Small portion

KEVIntel has not attributed these payload families to a named threat actor or a single coordinated campaign.

Exploitation timeline

Date	Event
18 July 2025	ZDI reported CVE-2026-0770 to the vendor
9 January 2026	ZDI publicly disclosed CVE-2026-0770
23 January 2026	GitHub Advisory Database publication
16 March 2026	ProjectDiscovery included a CVE-2026-0770 template in Nuclei Templates 10.4.0
27 June 2026	KEVIntel first observed Langflow validation-endpoint exploitation attempts
15–21 July 2026	KEVIntel recorded 75 events from 20 source IPs
21 July 2026	CISA added CVE-2026-0770 to KEV
24 July 2026	CISA federal remediation deadline

Affected and patched versions

Public vulnerability records currently provide inconsistent information about CVE-2026-0770’s affected and patched versions.

Available records variously reference:

• Langflow 1.4.2
• Later releases through 1.7.3
• A ProjectDiscovery template labelled for versions below 1.3.0
• No consistently documented fixed release for CVE-2026-0770

The <1.3.0 range is also associated with CVE-2025-3248, which increases the risk of confusing the two vulnerabilities.

Defenders should not rely solely on a version range copied from scanner metadata.

Confirm exposure using current Langflow guidance and determine whether the vulnerable validation functionality is reachable in the deployed configuration.

Patching CVE-2025-3248 should not be treated as proof that CVE-2026-0770 is also resolved.

Detection guidance

HTTP request detection

Prioritize requests matching:

Method: POST
Path: /api/v1/validate/code
Content-Type: application/json

Inspect the submitted code value for:

exec(
@exec
subprocess
check_output
os.popen
os.system
__import__
throw(Exception
shell=True
wget
curl
| sh
/bin/sh
/bin/bash

Useful payload or response markers include:

OUTPUT:
PWNED-
LFPROBE_
/etc/passwd
CVE-2025-3248-VULN

The endpoint and Python execution primitives are stronger detection signals than source IPs or User-Agent values.

This detection covers suspicious activity associated with both CVE families rather than attempting to distinguish them solely from network syntax.

Example SIEM search

Field names will vary, but a generic search could resemble:

http.request.method:"POST"
AND url.path:"/api/v1/validate/code"
AND (
  http.request.body.content:"exec("
  OR http.request.body.content:"@exec"
  OR http.request.body.content:"subprocess"
  OR http.request.body.content:"os.popen"
  OR http.request.body.content:"os.system"
  OR http.request.body.content:"throw(Exception"
  OR http.request.body.content:"wget"
  OR http.request.body.content:"curl"
)

Where request bodies are not currently logged, defenders may consider enabling limited, securely stored body logging for this endpoint while avoiding collection of unrelated sensitive information.

User-Agent values observed

KEVIntel observed:

Go-http-client/1.1
python-requests/2.x
curl/8.5.0
Mozilla/5.0

Other requests used browser-like Chrome or Safari identifiers, empty values or malformed User-Agent strings.

These values can support investigation but should not be used as standalone blocking indicators.

Host-level detection

Review Langflow hosts for:

• Shell processes launched by Python or the Langflow process
• wget or curl spawned by the application
• Unexpected files in /tmp or /var/tmp
• Newly created shell scripts
• Outbound connections to unfamiliar infrastructure
• Access to 169.254.170.2
• Reads of .env or AWS credential files
• Unexpected child processes
• New cron jobs, services or startup entries
• Unexplained use or rotation of application API keys

Remediation

Defenders should:

1. Remove Langflow management and validation functionality from direct internet exposure.
2. Restrict access using a VPN, private network or strict allowlist.
3. Block untrusted access to POST /api/v1/validate/code.
4. Review current Langflow security guidance before selecting a remediated version.
5. Do not assume that updating for CVE-2025-3248 also resolves CVE-2026-0770.
6. Search reverse-proxy and application logs for historical access to the validation endpoint.
7. Review process, network and filesystem telemetry for evidence of command execution.
8. Rotate LLM, API, database and cloud credentials where exploitation may have succeeded.
9. Revoke and replace cloud roles where metadata access is detected.
10. Rebuild affected systems from a trusted image if malware execution is confirmed.

Removing public exposure reduces immediate risk but is not sufficient incident response where historical exploitation evidence is present.

Temporary WAF guidance

A temporary control can deny external requests matching:

POST /api/v1/validate/code

Where legitimate access is required, restrict the endpoint to approved administrative networks.

Body inspection can also flag or block high-confidence execution patterns such as:

@exec
subprocess
os.popen
os.system
throw(Exception

Blocking the endpoint may affect legitimate Langflow code-validation functionality. Test controls before deployment and treat them as temporary risk reduction rather than a replacement for remediation.

Indicators from KEVIntel telemetry

Request path

/api/v1/validate/code

Payload strings

@exec
exec(
subprocess
check_output
os.popen
os.system
throw(Exception
LFPROBE_
OUTPUT:
PWNED-
CVE-2025-3248-VULN

Commands and targets

cat /etc/passwd
id
whoami
hostname
env
169.254.170.2
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI

Payload-hosting infrastructure

94.154.43[.]10
104.238.34[.]222
91.92.40[.]118
103.79.185[.]121

Use these indicators alongside endpoint, payload, process and network telemetry. IP addresses and filenames may be changed, reused or reassigned.

Limitations

• KEVIntel records requests received by its sensors, not total worldwide exploitation volume.
• A received request does not prove that an external production system was compromised.
• Some submitted payloads were malformed, incomplete or unlikely to return output.
• The endpoint is associated with two separate Langflow CVEs.
• Payload syntax identifies likely tooling families, not necessarily the exact vulnerability targeted.
• KEVIntel did not observe the intended target version of the sender’s scans.
• Monitor ownership provides operational attribution but does not prove the vulnerable code path exercised.
• Public records currently disagree about affected and patched CVE-2026-0770 versions.
• Source IP geolocation does not establish an attacker’s physical location.
• Payload-hosting infrastructure does not establish campaign ownership or attribution.

Conclusion

CVE-2026-0770 is now listed in CISA’s Known Exploited Vulnerabilities catalog, confirming that the issue has been exploited in the wild.

Before its addition, KEVIntel observed 137 exploitation attempts against Langflow’s /api/v1/validate/code endpoint from 46 unique source IP addresses.

The telemetry includes payloads matching public CVE-2026-0770 tooling, payloads matching CVE-2025-3248 tooling and generic Python execution attempts that cannot be reliably assigned to either CVE.

Most activity involved command-execution checks or system reconnaissance. However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files.

Organizations operating Langflow should investigate historical requests to /api/v1/validate/code, review host activity, restrict access to the validation functionality and rotate exposed credentials where successful execution cannot be ruled out.

View the latest exploitation status and telemetry on the KEVIntel CVE-2026-0770 page.

Frequently asked questions

Is CVE-2026-0770 in CISA KEV?

Yes. CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog on 21 July 2026.

Did KEVIntel observe 137 confirmed CVE-2026-0770 attempts?

KEVIntel observed 137 exploitation attempts against Langflow’s code-validation endpoint.

Some requests match public CVE-2026-0770 tooling. Others match CVE-2025-3248 tooling or use generic execution primitives that cannot be attributed to either CVE from the request alone.

Why are CVE-2025-3248 and CVE-2026-0770 difficult to distinguish?

Both are associated with POST /api/v1/validate/code and attacker-controlled Python reaching unsafe execution logic.

Payload style can indicate a likely public tooling family, but it does not establish the target version or exact vulnerable code path.

Does patching CVE-2025-3248 also fix CVE-2026-0770?

It should not be assumed to do so. CVE-2026-0770 was documented against a later Langflow build and concerns a separately identified issue.

What did the observed payloads attempt to execute?

Observed activity included id, whoami, cat /etc/passwd, environment-variable collection, malware downloaders and attempts to access AWS credentials and ECS task-role metadata.

Did KEVIntel confirm that external organizations were compromised?

No. KEVIntel observed exploitation attempts against its sensors. The telemetry establishes attacker intent and exploit delivery, but it does not prove compromise of unrelated production systems.

What should Langflow administrators do?

Restrict access to the validation endpoint, follow current Langflow remediation guidance, inspect historical requests and host telemetry, and rotate accessible credentials where successful code execution cannot be ruled out.