The **CISA** has issued a high-priority alert, adding **CVE-2026-0770** to its Known Exploited Vulnerabilities (**KEV**) catalog. This critical RCE vulnerability in the **Langflow** AI agent framework allows unauthenticated attackers to execute code as root, with minimal complexity. ### The Mechanics of the Exploit Researchers at **Trend Micro**, who discovered and reported the flaw, detailed its nature. The vulnerability stems from improper handling of the `exec_globals` parameter within the `validate` endpoint. This allows for the inclusion of resources from untrusted control spheres, enabling attackers to execute arbitrary code with root privileges. ### In-the-Wild Exploitation Confirmed Vulnerability intelligence firm **KEVIntel** was the first to detect in-the-wild exploitation of **CVE-2026-0770** on June 27. Prior to **CISA**'s inclusion of the flaw in its **KEV** catalog, over 220 exploitation attempts were recorded from 64 distinct IP addresses. Ryan Dewhurst, founder of **KEVIntel**, confirmed that the malicious activity extends beyond mere vulnerability checks. Attackers have been observed attempting to deploy malware, exfiltrate **AWS** credentials, environment variables, and container metadata. > "Most activity involved command-execution checks or system reconnaissance. However, KEVIntel also observed attempts to download second-stage scripts and access environment variables, cloud metadata and credential files," Dewhurst stated. He advised organizations running **Langflow** to investigate historical requests to `/api/v1/validate/code`, review host activity, restrict access to validation functionality, and rotate exposed credentials if successful execution cannot be ruled out.  ### Federal Agencies Ordered to Take Immediate Action On Tuesday, **CISA** officially added **CVE-2026-0770** to its **KEV** catalog. This mandates that U.S. Federal Civilian Executive Branch (**FCEB**) agencies secure their systems by Friday, in accordance with Binding Operational Directive (**BOD**) 26-04. **CISA** warned, "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." The agency emphasized that stakeholders are responsible for evaluating asset internet exposure and ensuring adherence to **BOD** 26-04 patching guidelines. This isn't the first time **Langflow** has been targeted. **CISA** has previously flagged other vulnerabilities in the framework as actively exploited. These include: * **CVE-2025-3248**: A missing authentication issue identified in May 2025. * **CVE-2026-33017**: A code injection vulnerability reported in March 2026. * **CVE-2026-55255**: An Insecure Direct Object Reference (**IDOR**) flaw flagged earlier this month. Notably, **CVE-2025-3248** is being actively exploited in ransomware attacks. Cloud security firm **Sysdig** reported that the **JadePuffer** ransomware gang is leveraging this flaw to dump **Langflow PostgreSQL** databases, highlighting the severe consequences of unpatched vulnerabilities in AI agent frameworks.