CISA adds Langflow RCE to KEV with July 24 remediation deadline

CISA added CVE-2026-0770 to the Known Exploited Vulnerabilities catalog on July 21, turning an older Langflow remote-code-execution advisory into an active patch priority. Covered U.S. federal agencies have a July 24 remediation deadline, and exposed self-hosted Langflow instances should not wait for that date.

The flaw matters because Langflow is commonly used to assemble AI agents, tools, model calls, and workflow components. A remotely exploitable issue in that layer can become a bridge from a public builder UI into the runtime that holds secrets, credentials, tools, and connected data.

CVE-2026-0770 targets Langflow's validate endpoint

NVD describes CVE-2026-0770 as an unauthenticated remote-code-execution vulnerability in Langflow's handling of the exec_globals parameter supplied to the validate endpoint. The record says the issue can let a remote attacker execute code in the context of root.

Zero Day Initiative published the original advisory in January after reporting the issue to the vendor in 2025. ZDI's mitigation advice was blunt: restrict interaction with the product when a fix is not available. That is still the right posture for internet-facing Langflow deployments until operators have verified the installed version, exposure, and surrounding controls.

CISA's KEV listing changes the urgency

CISA's July 21 KEV update says CVE-2026-0770 is now associated with active exploitation. The catalog entry sets July 24, 2026, as the due date for federal civilian executive branch agencies under CISA's binding remediation process.

That deadline is not only a government compliance marker. KEV placement is a useful operational signal for private teams because it separates "serious vulnerability" from "serious vulnerability with observed exploitation." If Langflow is reachable from the public internet, connected to production credentials, or available to multiple internal users, treat the exposure as a live incident-risk question rather than a routine backlog item.

What Langflow operators should verify

Start with the deployment boundary. Identify every Langflow instance, including developer sandboxes, Docker Compose setups, cloud-hosted demos, and internal copies exposed through VPN, reverse proxy, or shared workspace networks.

Then check the installed version. CISA points operators to the Langflow 1.9.0 release, while NVD lists affected configurations including Langflow 1.4.2 and versions up to and including 1.7.3. If your environment is behind the current release line, upgrade or isolate it before reopening access.

Teams should also rotate credentials that may have been available to the Langflow process, especially API keys for model providers, vector databases, cloud storage, GitHub, Slack, and internal HTTP tools. Review recent flow edits, unexpected component changes, new global variables, unusual outbound connections, and container or host-level process activity.

Agent builders need tighter defaults

Langflow is part of a broader pattern: visual AI workflow tools often sit close to powerful credentials while encouraging fast experimentation. That combination makes patch hygiene, network isolation, and least-privilege API keys more important than in a simple prototype app.

For new deployments, put Langflow behind authentication, avoid direct public exposure, separate development and production credentials, and keep tool permissions narrow. Teams building agent stacks can pair this incident with LinkLoot's guide to AI agent tools when deciding which tools deserve production access.

Evidence

CISA is the primary source for the active-exploitation signal and the July 24 remediation deadline. NVD provides the vulnerability description, affected-version context, and CISA ADP update showing active exploitation on July 21. Zero Day Initiative provides the original technical advisory, and the Langflow 1.9.0 release is the vendor-side update CISA references for remediation.