CVE-2026-0770

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.3.0

Description Remote attackers can execute arbitrary code on affected installations without requiring authentication. The issue stems from the inclusion of a resource from an untrusted control sphere within the handling of the exec globals parameter provided to the 'validate' endpoint. This flaw allows an attacker to execute code in the context of root.

Recommendations Update to version 1.3.0 or later. As a temporary workaround, restrict access to the 'validate' endpoint to minimize the risk of exploitation.