Unauthenticated Eval Injection RCE in Langflow (eval_custom_component_code)
CVSS 3.0
9.8critical
EPSS
38%p98
Published
()
Modified
AI analysis
CVE-2026-0769 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Langflow, an open-source platform for building LLM applications, located in the eval_custom_component_code function. The function fails to properly validate a user-supplied string before using it to execute Python code, so a remote attacker who can reach the Langflow service without any credentials can submit a crafted string that is then executed as Python code. Successful exploitation yields arbitrary code execution in the context of the current process, with full confidentiality, integrity, and availability impact on the affected host. Any Langflow deployment is potentially exposed, particularly self-hosted or internet-facing instances that accept unauthenticated API requests. Exploitation of critical Langflow flaws has been reported in the wild in recent credential-focused campaigns; this CVE itself is not yet in CISA KEV and has no known public PoC, but its EPSS of 38% (98th percentile) signals high near-term exploitation risk.
What to do: Upgrade Langflow to the patched release identified in the ZDI/Trend Micro advisory (ZDI-CAN-26972) as soon as it is available, since the flaw is fixed by proper validation in updated code. Until patched, restrict unauthenticated network access to Langflow instances — put them behind reverse-proxy authentication, firewall them from the internet, and monitor for signs of compromise such as unexpected child processes or outbound connections spawned by the Langflow service.
Affected
langflow
—
Estimated exposure
moderate≈1,000–5,000 internet-exposed Langflow instances (total install base, including private/self-hosted deployments, unknown) — Public internet scans during earlier Langflow RCE exploitation campaigns have typically surfaced low thousands of exposed Langflow servers, while the framework's popularity among LLM developers implies a larger, harder-to-count base of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
VulnCheck observed active exploitation of CVE-2026-0768 (CVSS 9.8) in Langflow and CVE-2026-66066 'KindaRails2Shell' (CVSS 9.5) in Ruby on Rails, with detections rising from 50 on August 30, 2026 to 360 by September 1. The Rails flaw allows unauthenticated arbitrary file reads, leaking secret_key_base, Rails master key, database passwords, cloud credentials and API tokens, ultimately enabling RCE; the patch still leaves the variation-key Marshal deserialization RCE gadget functional. Observed chains include a Python credential harvester with SimpleHelp remote access via CVE-2026-5027, and weaponization of CVE-2025-3248 to enlist hosts into an XMR mining botnet after disabling auditd. More than 7,100 exposed vulnerable Ruby on Rails instances and over 15,000 successful exploitation attempts across three Langflow flaws were recorded.