CISA KEV Catalog Addition Including Langflow Untrusted Code Inclusion Vulnerability (CVE-2026-0770)

Technical Analysis

CVE-2026-0770 is categorized as 'Inclusion of Functionality from Untrusted Control Sphere,' suggesting Langflow can be induced to load or execute code/components/plugins from an untrusted source, which in an agent-orchestration context could allow an attacker to inject malicious flow components, tools, or logic into a running agent pipeline. Since Langflow is used to visually construct LLM/agent workflows (chains, tools, prompts), this class of vulnerability could enable an attacker to hijack tool execution, exfiltrate credentials/secrets embedded in flows, or achieve remote code execution on the host running the Langflow server. The entry point is likely the Langflow web UI/API accepting untrusted flow definitions, custom components, or imports without sufficient sandboxing or validation, crossing the boundary from configuration/data into executable agent logic. CISA confirms active exploitation in the wild, elevating urgency beyond typical CVSS-only risk scoring. The other three CVEs (DD-WRT, WordPress x2) are standard web/network CVEs with no agentic AI relevance.

Affected Systems

Langflow

Detection Signatures

• Monitor Langflow server logs for unexpected flow imports, custom component uploads, or execution of components not authored internally
• Alert on outbound network connections from Langflow host to unfamiliar domains following flow load
• Review Langflow instance exposure to the public internet; flag any unauthenticated or weakly authenticated admin/API endpoints
• Audit for unexpected process spawning or file writes originating from the Langflow application process
• Check for anomalous API calls to /api/v1/ endpoints handling flow or component uploads

Remediation Steps

1. 1

   Patch Langflow immediately

   Upgrade to the fixed Langflow version addressing CVE-2026-0770 as soon as available from the vendor.

2. 2

   Restrict network exposure

   Ensure Langflow instances are not publicly accessible without authentication; place behind VPN or strict access controls.

3. 3

   Validate flow/component sources

   Disable or restrict import of flows, custom components, or code from untrusted or external sources; implement allowlisting.

4. 4

   Follow BOD 26-04 guidance

   FCEB agencies must remediate per CISA KEV timelines and check for prior compromise indicators before/after patching.

5. 5

   Audit historical activity

   Review logs for evidence of exploitation prior to patch deployment, consistent with BOD 26-04 compromise-check requirements.