US government orders emergency fix for Langflow AI tool after hackers exploit it in the wild

Key points

• CISA on Tuesday ordered federal agencies to patch a critical Langflow flaw, CVE-2026-0770, by Friday.
• Vulnerability tracking firm KEVIntel logged more than 220 exploitation attempts from 64 unique IP addresses starting June 27, 2026.
• The bug lets an unauthenticated attacker run commands as root, the highest level of access on a server.
• Trend Micro researchers found and reported the flaw, which sits in Langflow's /api/v1/validate/code endpoint.
• Attackers have already tried to steal AWS credentials and cloud metadata from vulnerable hosts.

CISA has ordered US federal agencies to patch a serious hole in Langflow, a popular open-source tool for building AI agents visually. The agency announced the directive Tuesday.

The flaw, CVE-2026-0770, carries a critical severity rating. In plain terms, it lets a stranger on the internet run any command they like on a Langflow server without a username or password, and those commands run as root, meaning full control of the machine.

Trend Micro researchers found the bug and reported it. The problem sits in how Langflow handles the exec_globals parameter sent to its validate endpoint. That endpoint is supposed to check whether a snippet of code is safe to run. Instead, it runs it.

How are attackers using this flaw?

They're already using it to break into exposed Langflow servers and steal cloud secrets. Vulnerability intelligence company KEVIntel first spotted real-world attacks on June 27, 2026. Its sensors logged more than 220 exploitation attempts from 64 different source addresses before CISA added the bug to its official watchlist.

KEVIntel founder Ryan Dewhurst told BleepingComputer that the attacks go beyond simple probing. Some payloads pull down second-stage malware. Others hunt for AWS keys, environment variables and container metadata, data that lets an attacker pivot from one compromised server into an entire cloud account.

"Most activity involved command-execution checks or system reconnaissance," Dewhurst said. "However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files."

His advice to Langflow users: check historical requests to /api/v1/validate/code, review what the host has been doing, lock down access to the validation feature, and rotate any credentials that might have been exposed.

What has CISA ordered?

On Tuesday, CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog, the list of bugs that federal agencies must patch on a tight clock. Under Binding Operational Directive 26-04, civilian federal agencies must patch, or take the affected system offline, by Friday.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA said in its notice.

The order only legally binds federal civilian agencies. Private companies running Langflow should treat the deadline as their own. Anything with the /api/v1/validate/code endpoint reachable from the internet is a target.

Why does this keep happening to Langflow?

This isn't the first Langflow bug to end up on CISA's exploited list. CVE-2025-3248, a missing-authentication flaw, was flagged in May 2025 and has since been used by the JadePuffer ransomware gang to dump Langflow databases, according to cloud security firm Sysdig. Two more Langflow flaws, a code-injection bug (CVE-2026-33017) and an access-control bug (CVE-2026-55255), were added earlier this year. We've tracked Langflow security issues across 14 stories in the past 90 days, a pace that reflects just how hard this platform is being targeted.

AI tooling is moving fast, security review is lagging, and the endpoints that make these platforms useful, running user-supplied code, connecting to cloud services, are exactly the ones attackers want.

What should Langflow users do right now?

Upgrade to the patched release, then assume you may already have been hit. Pull logs, look for POST requests to /api/v1/validate/code, and rotate every credential the server could reach. If Langflow is sitting on the public internet, put it behind a VPN or an authenticated proxy. There's no good reason for a code-execution endpoint to be exposed to anyone with a browser.