CVE entry · CVE-2026-0770
CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
- Actively exploited: added to CISA’s KEV catalog on July 21, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: July 24, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Langflow, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.