US government orders emergency fix for Langflow AI tool after hackers exploit it in the wild

Key points

• The US Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday ordered federal agencies to patch a critical Langflow flaw, CVE-2026-0770, by Friday.
• Vulnerability tracking firm KEVIntel logged more than 220 exploitation attempts from 64 unique IP addresses starting June 27, 2026.
• The bug lets an unauthenticated attacker run commands as root, the highest level of access on a server.
• Trend Micro researchers found and reported the flaw, which sits in Langflow's /api/v1/validate/code endpoint.
• Attackers have already tried to steal Amazon Web Services credentials and cloud metadata from vulnerable hosts.

CISA has told US federal agencies to drop everything and patch a serious hole in Langflow, a popular open-source tool for building AI agents visually. The deadline is Friday.

The flaw is tracked as CVE-2026-0770. It carries a critical severity rating and, in plain terms, lets a stranger on the internet run any command they like on a Langflow server without needing a username or password. Worse, those commands run as root, meaning full control of the machine.

Trend Micro researchers found the bug and reported it. The problem sits in how Langflow handles the exec_globals parameter sent to its validate endpoint. That endpoint is supposed to check whether a snippet of code is safe to run. Instead, it runs it.

How are attackers using this flaw?

They are already using it to break into exposed Langflow servers and steal cloud secrets. Vulnerability intelligence company KEVIntel first spotted real-world attacks on June 27, 2026. Its sensors logged more than 220 exploitation attempts from 64 different source addresses before CISA added the bug to its official watchlist.

KEVIntel founder Ryan Dewhurst told BleepingComputer that the attacks go well beyond simple probing. Some of the payloads try to pull down second-stage malware. Others hunt for Amazon Web Services keys, environment variables, and container metadata, the kind of data that lets an attacker pivot from one broken server into an entire cloud account.

"Most activity involved command-execution checks or system reconnaissance," Dewhurst said. "However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files."

His advice to Langflow users: check historical requests to /api/v1/validate/code, review what the host has been doing, lock down access to the validation feature, and rotate any credentials that might have been exposed.

What has CISA ordered?

On Tuesday, CISA added CVE-2026-0770 to its Known Exploited Vulnerabilities catalog, the list of bugs that federal agencies must patch on a tight clock. Under Binding Operational Directive 26-04, civilian federal agencies have until Friday to either patch, apply a workaround, or take the affected system offline.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA said in its notice.

The order only legally binds federal civilian agencies. But private companies running Langflow should treat the deadline as their own. Anything with the /api/v1/validate/code endpoint reachable from the internet should be considered a target.

Why does this keep happening to Langflow?

This is not the first Langflow bug to end up on CISA's exploited list. CVE-2025-3248, a missing-authentication flaw, was flagged in May 2025 and has since been used by the JadePuffer ransomware gang to dump Langflow databases, according to cloud security firm Sysdig. Two more Langflow flaws, a code-injection bug (CVE-2026-33017) and an access-control bug (CVE-2026-55255), were added earlier this year.

The pattern is familiar. AI tooling is moving fast, security review is lagging, and the endpoints that make these platforms useful (running user-supplied code, connecting to cloud services) are exactly the ones attackers want.

What should Langflow users do right now?

Upgrade to the patched release, then assume you may already have been hit. Pull logs, look for POST requests to /api/v1/validate/code, and rotate every credential the server could reach. If Langflow is sitting on the public internet, put it behind a VPN or an authenticated proxy. There is no good reason for a code-execution endpoint to be exposed to anyone with a browser.