Critical Langflow vulnerability fully opens doors to hackers and is under active exploitation
Hackers are already taking advantage.
Image by Cybernews.
The US cyber watchdog is alerting federal agencies and other users to the active exploitation of a Langflow critical vulnerability.
Langlow is a self-hosted, open-source low-code (drag-and-drop) tool for building and deploying AI-powered agents and workflows. It exploded in popularity, rocketing past 150,000 stars on GitHub.
The US Cybersecurity and Infrastructure Security Agency (CISA) warns that attackers are actively exploiting a critical flaw with a near-maximum severity rating of 9.8 out of 10. CISA added the bug to its Known Exploited Vulnerabilities list, giving federal agencies until July 24th to fix the issue or isolate any affected systems.
The bug, tracked as CVE-2026-0770, allows remote hackers to run arbitrary code on affected Langflow installations without any authentication.
What's notable is that the flaw is not new – it was publicly disclosed by the Zero Day Initiative over 6 months ago and reported to the maintainers even earlier, in July last year. Langflow acknowledged that attackers can run code “in the context of root.”
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
According to the advisory, the issue affected Langflow version 1.7.3 and earlier.
To date, the fix status remains “None” per the GitHub advisory, leaving uncertainty about whether the bug was ever patched. The current release is version 1.10.2.
KEVIntel, a cybersecurity company, said it observed 137 confirmed exploitation attempts, which began at least 24 days prior to CISA’s alert.
“The vulnerability affects Langflow’s code-validation functionality. Attacker-controlled Python can reach unsafe execution logic involving exec_globals, allowing code to run in the context of the Langflow process,” KEVIntel explained.
The payloads also matched another earlier critical vulnerability from last year, CVE-2025-3248, and attackers are delivering command-execution checks, malware downloaders, and attempting to access credentials.
The researchers suggest organizations operating Langflow to investigate historical requests to /api/v1/validate/code endpoint and review host activity – any compromised credentials should be rotated.