CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, a self-hosted visual builder for AI/LLM workflows, caused by the exec_globals parameter on its validate endpoint including functionality from an untrusted control sphere, and it was disclosed by Trend Micro's Zero Day Initiative as a zero-day after the vendor did not ship a confirmed fix within ZDI's disclosure window, then confirmed exploited in the wild and added to CISA's KEV catalog.
Vulnerability summary
9.8
Critical
62.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-01-23
Published
Vulnerability ID: CVE-2026-0770 · Source: NVD (ZDI/Trend Micro CNA Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Langflow | cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* | Through 1.7.3 per NVD's CPE match data; the Zero Day Initiative published this as a zero-day because Langflow had not shipped a confirmed fix as of the January 2026 public advisory, and CISA's KEV notes point to the v1.9.0 release as the remediation reference |
What this means
CVE-2026-0770 is an Inclusion of Functionality from Untrusted Control Sphere vulnerability (CWE-829) in Langflow, a self-hosted, low-code builder for AI/LLM agent workflows. The flaw sits in the handling of the exec_globals parameter passed to Langflow's validate endpoint: because the endpoint builds its execution environment from a resource under attacker control, a remote attacker can submit a crafted request and have Langflow execute arbitrary code — authentication is not required (NVD; ZDI-26-036).
NVD's vulnStatus for this record is Analyzed, but the only CVSS metric on file is a Secondary rating submitted by Trend Micro's Zero Day Initiative CNA: CVSS v3.0 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. NVD has not published its own independent Primary CVSS score. NVD's CPE match data marks Langflow versions through 1.7.3 as vulnerable (NVD).
ZDI's own advisory timeline shows the vendor was first notified on 2025-07-18, then given a status inquiry (2025-09-11) and a fix request (2025-10-10) before ZDI issued a zero-day publication notice on 2025-12-10 and the public advisory on 2026-01-09 — meaning the issue was disclosed without a vendor-confirmed patch in place at publication time (ZDI-26-036).
CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-21, with a required-action due date of 2026-07-24 and a forensic-triage requirement under BOD 26-04; the catalog's remediation notes point administrators to the Langflow v1.9.0 release. Known ransomware-campaign use is recorded as "Unknown" (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.6256 (99.188th percentile), reflecting sustained scanning and exploitation activity against internet-exposed Langflow instances (FIRST EPSS).
Because Langflow instances are often deployed by teams experimenting with AI agent pipelines and exposed with minimal hardening, any installation on 1.7.3 or earlier should be upgraded to a current release and should not be reachable from the open internet without authentication in front of it.
Evidence
- Unauthenticated remote code execution via the exec_globals parameter of Langflow's validate endpoint, which includes functionality from an untrusted control sphere. — NVD
- CVSS v3.0 base score is 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — a ZDI/Trend Micro CNA Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. Vulnerable versions run through 1.7.3 per NVD's CPE data. — NVD
- Vendor notified 2025-07-18; status inquiry 2025-09-11; fix request 2025-10-10; zero-day publication notice 2025-12-10; public advisory published 2026-01-09, without a vendor-confirmed patch at that time. — Zero Day Initiative Advisory ZDI-26-036
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-21, due date 2026-07-24, forensic-triage required under BOD 26-04, remediation notes reference the Langflow v1.9.0 release. — CISA KEV
- EPSS score is 0.6256 (99.188th percentile) as of 2026-10-30. — FIRST EPSS
