CVE-2026-0768criticalobserved exploitationCWE-94

CVE-2026-0768: critical vulnerability in Langflow

Langflow code Code Injection Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Langflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Patch now. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.8epss 28%
from disclosure to weapon221 days
Published on NVDJan 23
1st PoC+221d
metasploit+222d
VulnCheck+218d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Langflow · Langflow
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Langflow

In the same product, most dangerous first.

CVE-2025-34291CRITICALLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEEPSS 93.2%KEVCVE-2026-0770CRITICALLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityEPSS 62.6%KEVCVE-2026-0769CRITICALLangflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityEPSS 41.2%CVE-2026-0772HIGHLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.2%CVE-2026-0771HIGHLangflow PythonFunction Code Injection Remote Code Execution VulnerabilityEPSS 0.6%