VulnSocial

CVE-2026-0769Active Exploitation(langflow / langflow)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Prioritize remediation for langflow langflow systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.

langflow CVEsBack to dashboard
5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-95

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • langflow

Threat summary

  • Active exploitation appears in 4 classified signals
  • Public PoC is present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 4 signals
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Peaked at 2 mentions on most recent observed day (2026-10-08)
  • 4 total mentions across 3 days

Affected systems

Vendors
langflow
Products
langflow

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-18: 1Mentions · 2026-09-22: 1Mentions · 2026-10-08: 2PoC Mentioned / Linked · 2026-09-22: 1Active Exploitation · 2026-09-18: 1Active Exploitation · 2026-09-22: 1Active Exploitation · 2026-10-08: 2Technical Details · 2026-09-18: 1Technical Details · 2026-09-22: 109-1809-2210-08
Signal classification1 categories
Active Exploitation
4100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-181
Active Exploitation1
2026-09-221
Active Exploitation1
2026-10-082
Active Exploitation2
Full discourse4 posts
  • Aikido Community Japan@AikidoCommJP
    Active Exploitation

    Aikido Intelのレポートを見て「えっ？」となった。 LangflowのCVEが昨日（9/18）上がっている。 CVE-2026-0769。 1月にZDIが未修正の0dayとして公開した、認証不要のRCE。CVSS 9.8。新しい脆弱性ではない。 それが8か月経ってまた目に入ってきた背景には、8月末にVulnCheckが公開した観測がありそうだ。 Langflowについて、2026年だけで悪用確認済みの脆弱性が11件増え、累計12件。 さらにCVE-2026-0769を含む3件だけで、カナリアへの成功した悪用試行が15,000件を超えている。 1件のCVEの話というより、Langflowそのものが継続して狙われている。 これだけ実悪用される脆弱性が続くと、これを基盤にエージェントを組むなら、かなり慎重にならざるを得ない。 Aikido Intel 日次レポート https://aikido-community.jp/intel/aikido-intel-20260919 #サイバーセキュリティ #脆弱性 #Langflow #AIエージェント #CVE #AikidoIntel

    Post summary

    The tweet reports that CVE-2026-0769, an unauthenticated RCE with CVSS 9.8, has been actively exploited with over 15,000 successful attempts, indicating ongoing real-world use.

    00021557
    2.0K followersView on X
  • ♫NØX♥H♪@_Why_Noot
    Active Exploitation

    NØX Echo Lineage Signal: CVE-2026-0769 Entity: Langflow Lineage: Public vulnerability → Observed exploitation Relationship: - Langflow → CVE-2026-0769 → Evidence → Operational Risk Current State: DISCLOSED, ACTIVE_EXPLOITATION Watch: - New infrastructure

    Post summary

    CVE-2026-0769 affecting Langflow is publicly disclosed and observed to be actively exploited, with no patch or PoC information currently provided.

    1000070
    9 followersView on X
  • ♫Why♥Not♪@Python_s_
    Active Exploitation

    NØØT Security Alerts Classification: Critical CVE: CVE-2026-0769 Product: Langflow Summary: VulnCheck reports real-world exploitation activity affecting Langflow / Langflow. Evidence: Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 24 Jun 2026 Source: https://vulncheck.com/ #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #Langflow #CVE_2026_0769 #ActiveExploitation #Exploit

    Post summary

    The alert confirms active real-world exploitation of CVE-2026-0769 in Langflow, with live exploitation observed by VulnCheck canaries, urging immediate remediation prioritization.

    0000068
    236 followersView on X
  • cybrmonk@cybr_monk
    Active Exploitation

    Langflow’s Critical RCE Is Now Exploitable in the Wild, CVE-2026-0769 Has Public PoC Code https://cybrmonk.com/blog/langflow-s-critical-rce-is-now-exploitable-in-the-wild-cve-2026-0769-has-public-poc-code #cybersecurity #threatintelligence https://t.co/Jd9NSOoCnm

    Post summary

    The tweet asserts CVE-2026-0769 in Langflow is exploitable in the wild with public PoC code, reflecting active exploitation. It confirms RCE vulnerability type and notes no disclosed patch.

    0000081
    45 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Applangflowlangflow1.3.2--

Explore more

Back to dashboardlangflow CVEslangflow vulnerabilities