Fri 9 Jan
Updated Mon 26 Oct
CVE-2026-0768
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLangflow unauthenticated code injection (CVE-2026-0768, CVSS 9.8): validate endpoint runs attacker-supplied Python, possibly as root
Trend Micro ZDI advisory ZDI-26-034 (public 9 January 2026; CVE-2026-0768) rates an unauthenticated code-injection flaw in Langflow at CVSS 9.8: the validate endpoint executes a user-supplied code string as Python, which ZDI says can run as root. NVD published the CVE on 23 January 2026 and records affected Langflow 1.4.2. Updated 2 Sep 2026 (BleepingComputer, 1 September US time; 1:54 am 2 September Perth): BleepingComputer says CVE-2026-0768 affects Langflow 1.4.2 and earlier and recommends upgrading to the latest available version, 1.11.6, which it says addresses all known Langflow flaws. No vendor, CISA or other source Cyberstack can cite has confirmed exploitation of CVE-2026-0768 in the wild; it was not in CISA's Known Exploited Vulnerabilities catalogue when checked on 26 October 2026. ZDI's published mitigation is to restrict interaction with the product. ZDI and NVD don't name a fixed build; BleepingComputer's 1.11.6 is its advice to run the latest release, not a vendor-confirmed fix for CVE-2026-0768. Do not internet-expose unauthenticated Langflow. Correction (26 Oct 2026): reports of exploitation against UK honeypots (50 rising to 360 attempts, traffic mainly from Russia, and attackers querying Langflow, OpenAI and AWS environment variables and the Langflow secret key) have been removed: The Hacker News and BleepingComputer attribute them to one threat-intelligence company's honeypot data, and no vendor, CISA or other independent source confirms them. An unlinked SecurityWeek credit has also been removed. (source: Trend Micro ZDI-26-034; BleepingComputer)