CISA has ordered federal agencies to patch a critical remote code execution flaw in Langflow, the open source framework used to build AI agents and retrieval pipelines, by July 24. It is the fourth time in 2026 that a Langflow vulnerability has landed on the agency’s Known Exploited Vulnerabilities catalog, a pace that is turning one AI orchestration tool into a running case study in how fast attackers move against software built to execute untrusted input by design.
A Pattern, Not an Incident
The new flaw, CVE-2026-0770, is a code injection issue that CISA classifies as inclusion of functionality from an untrusted control sphere. According to CISA’s Known Exploited Vulnerabilities catalog, the bug allows a remote attacker to execute arbitrary code on affected Langflow installations. The vulnerability lives in Langflow’s validate endpoint, where the platform did not adequately isolate the exec_globals parameter used to run flow logic. An unauthenticated attacker who can reach an exposed Langflow instance can submit a single crafted request and execute code with the same privileges as the Langflow process itself, no credentials or user interaction required. Trend Micro researchers identified and reported the flaw.
Attackers Moved a Month Before the Catalog Did
Exploitation did not wait for CISA’s paperwork. KEVIntel, a vulnerability intelligence firm that tracks in-the-wild activity ahead of formal disclosure, first observed scanning and exploitation attempts on June 27, nearly four weeks before CISA added the flaw to its catalog on July 21. KEVIntel logged more than 220 exploitation attempts from 64 unique source IP addresses in that window. Founder Ryan Dewhurst said most of that activity involved command-execution checks or system reconnaissance, but some attackers went further, with attempts to download second-stage scripts and access environment variables, cloud metadata, and credential files. In practice, that means an attacker who lands on a vulnerable Langflow instance is not just proving the bug works. They are pulling AWS credentials, container metadata, and environment secrets out of the box in the same session, the kind of cloud pivot that turns an application flaw into a full account compromise.
The Fourth Strike in Five Months
Langflow’s presence on the KEV list is no longer a one-off. CISA has added four separate Langflow vulnerabilities to the catalog since March: a code injection flaw in the platform’s public flow-build endpoint in March, an origin-validation and CORS flaw in May, an authorization bypass that CyberTech covered in early July, and now this exec_globals code injection flaw. Each entry carried its own short federal patch deadline under Binding Operational Directive 26-04, meaning agencies running Langflow have had to scramble against the clock four separate times this year for the same product.
The product is not alone in drawing this kind of attention. CyberTech has also tracked the NadMesh botnet’s mass scanning of exposed AI developer tools for cloud keys and Kubernetes tokens, part of a broader pattern in which AI infrastructure that was rushed into production is now the softer target next to hardened, decade-old enterprise software.
The Discovery-to-Exploitation Gap Keeps Shrinking
The timeline is the part defenders should sit with. KEVIntel’s telemetry shows sustained exploitation underway a full month before CISA’s catalog entry forced the issue onto federal patch queues on July 21. The older assumption behind vulnerability management, that disclosure and patching happen on a schedule agencies control, no longer holds for AI infrastructure targets. By the time a KEV entry appears, exploitation is typically already a fact on the ground, which makes the federal deadline closer to incident containment than prevention.
What It Means for the Security Leader
The repeat appearances point to a structural problem, not a single bad patch. Langflow, like other AI agent and workflow platforms, is designed to accept and execute logic supplied by users and, in many deployments, by external callers building automations against it. That design goal, flexible, low-code execution of arbitrary flows, is difficult to fully separate from the same primitive that attackers need for remote code execution. Security teams that adopted Langflow or comparable AI orchestration frameworks for internal automation should not treat any single patch as closing the book. Instances exposed to the internet, especially anything reachable without authentication, deserve the same continuous scrutiny given to internet-facing VPN and file-transfer appliances that dominated last year’s ransomware entry points. Procurement and AppSec teams evaluating new AI orchestration or agent platforms should ask vendors directly how flow-execution endpoints are authenticated and sandboxed before deployment, not after the first KEV notice arrives.
What to Do Now
Update Langflow to a release that specifically addresses CVE-2026-0770, since the platform’s rapid succession of flaws means a fix aimed at one CVE will not necessarily close another. Inventory every internet-facing Langflow deployment and remove public exposure of the validate and flow-build endpoints where they are not explicitly required. Treat any instance reachable between late June and the July patch as potentially compromised: check for anomalous outbound connections to cloud metadata services, unexpected environment variable or credential file access, and unrecognized scheduled tasks or second-stage scripts. Federal agencies face a July 24 deadline under BOD 26-04; every other organization running Langflow should work to the same clock rather than waiting for a fifth entry on the list.
