← fix library

FIX CARD
PRODUCT Langflow
SEVERITY CRITICAL

CRITICAL

Langflow CVE-2026-0770 — unauthenticated RCE via exec_globals

Why it matters

A second, independent unauthenticated remote-code-execution path in Langflow, added to CISA's actively-exploited list in July 2026. No login needed, code runs as root. If your Langflow is exposed, assume someone is already trying it.

Fix it: 3 steps

  1. Upgrade to the newest Langflow release — the advisory lists no clean fixed version, so current is the only safe answer.
  2. Block public access in the meantime: sudo ufw deny 7860, or put the UI behind an authenticating proxy.
  3. If it was exposed and unpatched, treat stored API keys and flow credentials as compromised and rotate them.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:7860/api/v1/version  # must be the latest release; anything <= 1.7.3 is in the affected range

References

CVE mapping behind this card: human-verified, last checked 2026-07-29.

Not sure if your stack is exposed?

Run the free check: usually under a minute, safe read-only probes.

Scan your stack