Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829)

let LangflowHosts = dynamic(["langflow", "langflow-server"]);
union isfuzzy=true
  (DeviceProcessEvents
  | where FolderPath has_any ("langflow") or InitiatingProcessFolderPath has_any ("langflow")
  | where InitiatingProcessCommandLine has_any ("custom_component", "import_str", "exec(", "eval(") 
  | where FileName in~ ("bash", "sh", "powershell.exe", "cmd.exe", "python", "python3", "curl", "wget")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName),
  (DeviceNetworkEvents
  | where InitiatingProcessFolderPath has "langflow"
  | where RemoteUrl has_any ("raw.githubusercontent", "pastebin", "transfer.sh", "http://") or ipv4_is_private(RemoteIP) == false
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, AccountName)
| sort by TimeGenerated desc

(index=endpoint OR index=sysmon) (process_path="*langflow*" OR parent_process_path="*langflow*")
[ search (process_name IN ("bash","sh","powershell.exe","cmd.exe","python","python3","curl","wget")) OR (process="*exec(*" OR process="*eval(*" OR process="*custom_component*") ]
| eval reason="langflow_untrusted_exec"
| append
    [ search index=network sourcetype=stream:http OR sourcetype=zeek_http process_path="*langflow*"
      | where NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("172.16.0.0/12", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip)
      | eval reason="langflow_remote_fetch" ]
| table _time, host, user, process_name, process, dest_ip, url, reason
| sort -_time

sequence by host.name with maxspan=5m
  [network where process.executable : "*langflow*" and
    not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")]
  [process where event.type == "start" and
    process.parent.executable : "*langflow*" and
    process.name : ("bash", "sh", "python*", "powershell.exe", "cmd.exe", "curl", "wget")]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, "Process Name", "Process CommandLine", "Parent Process Name", username
FROM events
WHERE ("Parent Process Name" ILIKE '%langflow%' OR "Process CommandLine" ILIKE '%langflow%')
AND ("Process Name" IN ('bash','sh','python','python3','powershell.exe','cmd.exe','curl','wget')
     OR "Process CommandLine" ILIKE '%custom_component%'
     OR "Process CommandLine" ILIKE '%exec(%'
     OR "Process CommandLine" ILIKE '%eval(%')
LAST 24 HOURS

_sourceCategory=endpoint OR _sourceCategory=network
| where process_path matches "*langflow*" or parent_process_path matches "*langflow*"
| where process_name matches "bash" or process_name matches "sh" or process_name matches "python*" or process_name matches "powershell.exe" or process_name matches "cmd.exe" or command_line matches "*custom_component*" or command_line matches "*exec(*" or command_line matches "*eval(*"
| count by host, process_name, command_line, parent_process_path
| sort -_count

rule cve_2026_0770_langflow_untrusted_exec {
  meta:
    author = "detection-engineering"
    description = "Detects Langflow process spawning shell/interpreter children consistent with CVE-2026-0770 exploitation"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /langflow/ nocase
    $proc.target.process.file.full_path = /(bash|sh|python|powershell\.exe|cmd\.exe|curl|wget)/ nocase
  outcome:
    $risk_score = 85
  condition:
    $proc
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName="*langflow*" OR ImageFileName="*langflow*"
| in(field=FileName, values=["bash", "sh", "python", "python3", "powershell.exe", "cmd.exe", "curl", "wget"])
| CommandLine="*custom_component*" OR CommandLine="*exec(*" OR CommandLine="*eval(*" OR true
| table([ComputerName, ParentBaseFileName, FileName, CommandLine, UserName, timestamp])
| sort(timestamp, order=desc)