KEVIntel first logged in-the-wild exploitation attempts against CVE-2026-0770 on June 27, recording more than 220 attempts from 64 unique source IP addresses — activity that prompted the Cybersecurity and Infrastructure Security Agency (CISA) to move the flaw into its Known Exploited Vulnerabilities (KEV) catalog and order immediate action.
What CVE-2026-0770 is and where it lives
The vulnerability, tracked as CVE-2026-0770, resides in the Langflow visual framework used to build AI agents. Trend Micro researchers who discovered and reported the flaw explain: "The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint." According to those researchers, "The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root." In short, unauthenticated actors can achieve remote code execution (RCE) as root in low-complexity attacks against the exposed endpoint.
Observed exploitation and attacker behavior
KEVIntel’s telemetry first flagged active exploitation on June 27. The company recorded over 220 exploitation attempts originating from 64 unique IP addresses before CISA added the bug to its KEV list. KEVIntel founder Ryan Dewhurst told BleepingComputer that attackers were not merely probing; malicious payloads attempted subsequent actions. "Most activity involved command-execution checks or system reconnaissance. However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files," Dewhurst said. He added that payloads observed during the attacks also sought to deploy malware and obtain AWS credentials, environment variables, and container metadata.
CISA order: federal agencies, a short compliance window
On Tuesday, CISA added CVE-2026-0770 to its KEV catalog and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure affected systems by Friday, invoking Binding Operational Directive (BOD) 26-04. The agency framed the urgency plainly: "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." CISA also reminded recipients that "Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines," making the expectation of prioritized remediation explicit for federal systems.
Other Langflow flaws and links to ransomware activity
CISA’s advisory places CVE-2026-0770 in a pattern: the agency has previously flagged other Langflow flaws exploited in the wild. Those include a missing authentication issue (CVE-2025-3248) in May 2025, a code injection flaw (CVE-2026-33017) in March 2026, and an Insecure Direct Object Reference (IDOR) (CVE-2026-55255) earlier this month. CISA additionally confirmed that CVE-2025-3248 is being exploited in ransomware attacks after cloud security firm Sysdig reported that the JadePuffer ransomware gang is using that earlier Langflow flaw to dump Langflow PostgreSQL databases. Taken together, the record shows repeated attacker interest in Langflow components and multiple active exploit chains.
What this means for security teams, federal agencies, and cloud operators
- Security teams and technologists: Investigate historical requests to /api/v1/validate/code and review host activity for signs of successful execution. KEVIntel recommends restricting access to the validation functionality and rotating exposed credentials where successful execution cannot be ruled out.
- Federal agencies (FCEB): Comply with BOD 26-04 timelines — CISA has ordered patching by Friday — and evaluate the internet exposure of Langflow assets as part of the required remediation steps.
- Cloud operators and DevOps teams: Treat attempts to access environment variables, container metadata, and cloud credentials as high risk; check for evidence of second-stage downloads or lateral movement and rotate any credentials that may have been exposed.
The facts are stark: an unauthenticated flaw that yields root-level remote code execution is being actively probed and weaponized, adversaries have demonstrated follow-on behavior aimed at stealing cloud credentials and deploying additional malware, and federal agencies now face a binding, short timetable to remediate under BOD 26-04. Organizations running Langflow should treat requests to /api/v1/validate/code as high-priority forensic leads and assume compromise is possible where evidence cannot definitively rule it out.
Source: BleepingComputer — CISA orders feds to patch actively exploited Langflow RCE flaw
