Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2026-0770)

The version of Langflow running on the remote host is affected by a code injection vulnerability in the 'validate_code()' function. The '/api/v1/validate/code' endpoint compiles and evaluates attacker-supplied Python during 'validation' - function default-argument values and decorators are executed via an unsandboxed exec() whose globals expose importlib and the Python builtins. Although the endpoint nominally requires authentication, the default 'AUTO_LOGIN=true' configuration accepts the default 'langflow'/'langflow' credentials, so a remote attacker can obtain a session and submit crafted code whose default argument executes arbitrary Python, and ultimately arbitrary operating system commands, as the Langflow service user.

Nessus confirmed the flaw non-destructively by authenticating with the default credentials and coercing the target into performing an out-of-band callback (a DNS lookup and/or a direct socket connection) back to the Nessus scanner. No operating system commands were executed on the target.

According to its banner, the version of Langflow running on the remote host is prior to 1.7.3. It is, therefore, affected by a remote code execution through 'validate_code() exec()'.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
334530	Langflow validate/code exec() Remote Code Execution (CVE-2026-0770) (Direct Check)	Nessus	Artificial Intelligence	Remote	critical
115320	Langflow < 1.7.3 Remote Code Execution	Web App Scanning	Artificial Intelligence	Version Based	critical

Detections

Analytics

CVE-2026-0770

critical

Tenable Plugins

Coming Soon

critical

critical