What it is
CVE-2026-0770 (CVSS 9.8) affects Langflow, an open-source platform for building AI workflows. On POST /api/v1/validate/code, the exec_globals parameter is passed to the code-validation handler and run with Python exec() without sandboxing. Zero Day Initiative disclosed it as a zero-day on January 9, 2026.
Exploitation and KEV
On July 21, 2026, CISA confirmed in-the-wild exploitation and added the CVE to the KEV catalog. The same day, NCSC-NL published CSC-2026-0251 covering multiple Langflow OSS 1.0.0–1.1.x CVEs fixed in 1.1.x.
Unauthenticated exploitation mainly hits operators who leave AUTO_LOGIN=true and keep the documented default credentials. The bug is severe, and misconfiguration leaves it open on the internet.
What to do
Disable AUTO_LOGIN, rotate the default account, upgrade to a fixed version and never expose Langflow without strong authentication. AI workflow tools often sit forgotten on demos and staging: treat them as critical infrastructure.