Detections
Analytics

Langflow validate/code exec() Remote Code Execution (CVE-2026-0770) (Direct Check)

critical Nessus Plugin ID 334530

Synopsis

The remote host is running a web application affected by a remote code execution vulnerability.

Description

The version of Langflow running on the remote host is affected by a code injection vulnerability in the 'validate_code()' function. The '/api/v1/validate/code' endpoint compiles and evaluates attacker-supplied Python during 'validation' - function default-argument values and decorators are executed via an unsandboxed exec() whose globals expose importlib and the Python builtins. Although the endpoint nominally requires authentication, the default 'AUTO_LOGIN=true' configuration accepts the default 'langflow'/'langflow' credentials, so a remote attacker can obtain a session and submit crafted code whose default argument executes arbitrary Python, and ultimately arbitrary operating system commands, as the Langflow service user.

Nessus confirmed the flaw non-destructively by authenticating with the default credentials and coercing the target into performing an out-of-band callback (a DNS lookup and/or a direct socket connection) back to the Nessus scanner. No operating system commands were executed on the target.

Solution

Upgrade to a fixed version of Langflow per the vendor advisory. As a mitigation, disable AUTO_LOGIN and change the default credentials so the vulnerable endpoint cannot be reached without valid authentication.

See Also

https://github.com/affix/CVE-2026-0770-PoC

https://www.zerodayinitiative.com/advisories/ZDI-26-036/

Plugin Details

Severity: Critical

ID: 334530

File Name: langflow_validate_code_rce_cve_2026_0770.nbin

Version: 1.1

Type: Remote

Published: 8/11/2026

Updated: 8/11/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.2

Percentile: 99.76

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:langflow:langflow

Required KB Items: installed_sw/Langflow

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/22/2026

Reference Information

CVE: CVE-2026-0770