Published on gastropod.io on 07-24-2026

Langflow Just Got Its Fifth CVE Added to CISA's Exploited List This Year

Tags: vulnerability intelligence, software supply chain security, ci-cd-security

CISA added a new flaw to its Known Exploited Vulnerabilities catalog on Tuesday (7-21-2026) and gave federal agencies until Friday to patch it. The software is Langflow, an open source Python framework for building AI agent workflows, and this is the fifth distinct Langflow CVE the agency has flagged as actively exploited in about a year.

The new one, CVE-2026-0770, is about as bad as these get. It lets an unauthenticated attacker run code as root through the exec_globals parameter on Langflow's validate endpoint. Trend Micro's Zero Day Initiative found and reported it. By the time CISA added it to the KEV catalog, the vulnerability intelligence firm KEVIntel had already logged more than 220 exploitation attempts from 64 separate source IPs, starting June 27. The activity wasn't limited to checking if a target was vulnerable. KEVIntel's telemetry shows attackers pulling down second-stage scripts and going after environment variables, cloud metadata, and credential files once they were in.

The pattern behind the pattern

This is not a one-off. CISA has now added five separate Langflow vulnerabilities to KEV: a missing-authentication flaw from May 2025 that's since been tied to ransomware, a code injection RCE from March, an authorization bypass disclosed earlier this month that let attackers reach other tenants' workflows, and now this one. Sysdig documented a single operator chaining that authorization bypass with an earlier RCE flaw over a four day period in June, using the access bypass to steal LLM provider keys and AWS credentials from other users on the same instance, and the RCE to take the host itself. The ransomware angle is real too: a gang tracked as JadePuffer has been using the oldest of the five flaws to dump Langflow's PostgreSQL databases.

The reason Langflow keeps showing up on this list isn't bad luck. It's that it is widely used and as a platform built for wiring together AI agent workflows it ends up as a single point that touches OpenAI keys, Anthropic keys, database credentials, and cloud tokens across every workflow anyone's built on it. Compromise the platform once and you have access to all of thiat.

Sources

• CISA orders urgent action on actively exploited Langflow RCE flaw (BleepingComputer)
• CVE-2026-0770 Exploited in the Wild: Langflow RCE Added to CISA KEV (KEVIntel)
• Understanding Langflow CVE-2026-55255 (Sysdig)
• CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA)

The real question isn't whether you use it. It's whether you'd know.

Langflow isn't a malicious package that snuck in through a typosquat or a hijacked maintainer account. It's a legitimate tool that plenty of teams pulled in deliberately to stand up agent workflows fast, and it now has five known, actively exploited vulnerabilities attached to its name in the space of a year. The question that matters isn't abstract: if a sixth one lands next month, do you know whether it's running anywhere in your environment, and could you answer that in the time it takes to read the advisory?

Gastropod correlates OSV advisories to every package version the moment they're published, not on the next scheduled scan. When a new one drops, you already know every place that artifact lives, because the query has already been run and the answer is sitting there waiting, not something you kick off after the fact. Direct and transitive dependents get flattened into edges you can actually query, so "does this touch anything downstream" is one lookup instead of a fleet-wide search. And because every pull is tied to a specific principal, if Langflow or anything like it is sitting somewhere in your stack, you know exactly where it came in and who's touching it, not just that it exists somewhere.

Five KEV entries for one package in a year is a pattern, not a coincidence, and the next one is only a matter of time. Worth seeing what your own dependency graph looks like with that kind of visibility built in.