← fix library

CRITICAL Langflow: Langflow CVE-2026-0770 — unauthenticated RCE via exec_globals

Why it matters

A second, independent unauthenticated remote-code-execution path in Langflow, added to CISA's actively-exploited list in July 2026. No login needed, code runs as root. If your Langflow is exposed, assume someone is already trying it.

Fix it — 3 steps

1. Upgrade to the newest Langflow release — the advisory lists no clean fixed version, so current is the only safe answer.
2. Block public access in the meantime: `sudo ufw deny 7860`, or put the UI behind an authenticating proxy.
3. If it was exposed and unpatched, treat stored API keys and flow credentials as compromised and rotate them.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:7860/api/v1/version  # must be the latest release; anything <= 1.7.3 is in the affected range

References

• https://github.com/advisories/GHSA-g22f-v6f7-2hrh