Detections
Analytics

Langflow validate/code exec() Remote Code Execution (CVE-2026-0770) (Direct Check)

critical Nessus Plugin ID 334530

Language:

Synopsis

The remote host is running a web application affected by a remote code execution vulnerability.

Description

The version of Langflow running on the remote host is affected by a code injection vulnerability in the 'validate_code()' function. The '/api/v1/validate/code' endpoint compiles and evaluates attacker-supplied Python during 'validation' - function default-argument values and decorators are executed via an unsandboxed exec() whose globals expose importlib and the Python builtins. Although the endpoint nominally requires authentication, the default 'AUTO_LOGIN=true' configuration accepts the default 'langflow'/'langflow' credentials, so a remote attacker can obtain a session and submit crafted code whose default argument executes arbitrary Python, and ultimately arbitrary operating system commands, as the Langflow service user.

Nessus confirmed the flaw non-destructively by authenticating with the default credentials and coercing the target into performing an out-of-band callback (a DNS lookup and/or a direct socket connection) back to the Nessus scanner. No operating system commands were executed on the target.

Solution

Upgrade to a fixed version of Langflow per the vendor advisory. As a mitigation, disable AUTO_LOGIN and change the default credentials so the vulnerable endpoint cannot be reached without valid authentication.

See Also

https://github.com/affix/CVE-2026-0770-PoC

https://www.zerodayinitiative.com/advisories/ZDI-26-036/

Plugin Details

Severity: Critical

ID: 334530

File Name: langflow_validate_code_rce_cve_2026_0770.nbin

Version: 1.2

Type: Remote

Published: 8/11/2026

Updated: 8/14/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-0770

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:langflow:langflow

Required KB Items: installed_sw/Langflow

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/22/2026

CISA Known Exploited Vulnerability Due Dates: 7/24/2026

Reference Information

CVE: CVE-2026-0770