CVE-2026-0770 Google Chronicle · YARA-L

Detect Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829) in Google Chronicle

Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.

MITRE ATT&CK

Tactic
Initial Access Execution

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_0770_langflow_untrusted_exec {
  meta:
    author = "detection-engineering"
    description = "Detects Langflow process spawning shell/interpreter children consistent with CVE-2026-0770 exploitation"
    severity = "CRITICAL"
  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /langflow/ nocase
    $proc.target.process.file.full_path = /(bash|sh|python|powershell\.exe|cmd\.exe|curl|wget)/ nocase
  outcome:
    $risk_score = 85
  condition:
    $proc
}
critical severity medium confidence

YARA-L rule flagging process-launch events where a Langflow parent process creates a shell, scripting, or downloader child process, aligning with untrusted-code-inclusion exploitation of CVE-2026-0770.

Data Sources

Chronicle UDM PROCESS_LAUNCH events

Required Tables

PROCESS_LAUNCH

False Positives & Tuning

  • Authorized Langflow custom component installs by platform administrators
  • Legitimate automated deployment tooling invoking shell commands under the Langflow service account
  • Test/staging environments intentionally exercising component-loading code paths

Other platforms for CVE-2026-0770

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Langflow custom component remote fetch

    Expected signal: Outbound HTTP/S connection from a process associated with the Langflow environment to an external GitHub raw content URL, captured in network/proxy logs.

  2. Test 2Simulate shell spawn from Langflow parent process

    Expected signal: Process creation event showing a bash child process spawned by a python3 process whose lineage/name references 'langflow', captured via Sysmon/EDR process telemetry.

  3. Test 3Simulate encoded PowerShell execution from Langflow process (Windows)

    Expected signal: Process creation event for powershell.exe with -EncodedCommand flag, ideally spawned by or associated with a process/service named 'langflow', captured in Windows Security/Sysmon Event ID 4688/1.

Last updated: 2026-07-22 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all Langflow instances in the environment and confirm their version against the fixed release v1.9.0; treat any instance below this version as vulnerable to CVE-2026-0770.
  2. Review Langflow server logs and process telemetry for evidence of custom component loading, remote flow imports, or execution of shell/interpreter children spawned by the Langflow process around the alert timeframe.
  3. Check outbound network connections from the Langflow host for calls to unexpected or non-allowlisted external URLs (e.g., raw.githubusercontent.com, pastebin-style domains) that may indicate fetching of untrusted component code.
  4. Determine whether the Langflow instance is internet-exposed or reachable from untrusted network segments, since CVE-2026-0770 is being actively exploited per CISA KEV and BOD 26-04 guidance.

Containment

  1. Isolate the affected Langflow host from the network or restrict inbound/outbound access at the firewall while investigation proceeds, particularly blocking outbound access to newly observed suspicious domains/IPs.
  2. Disable or restrict the Langflow custom-component/flow-import functionality (or take the service offline) until it is patched to v1.9.0 or later, per the vendor release notes.

Evidence Collection

  1. Preserve Langflow application logs, web server access logs, and full process execution history (parent/child chains) from the affected host for the suspected exploitation window.
  2. Capture memory and disk artifacts of the Langflow host, including any dropped files, downloaded components, or scripts referenced in exec/eval calls, and hash them for reputation lookups.

Escalation Criteria

  • !Escalate immediately if evidence shows successful remote code execution, unauthorized process spawns, or outbound connections to known-malicious infrastructure originating from the Langflow host.
  • !Escalate to incident response leadership if the Langflow instance is internet-facing, unpatched, and CISA KEV/BOD 26-04 deadlines for remediation have passed or are imminent.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Langflow application/audit logs showing custom component uploads, flow imports, or execution requests from unexpected source IPs
  • >Process creation events (parent Langflow process spawning shell/interpreter children) captured via EDR or Sysmon
  • >Network connection logs from the Langflow host to external URLs used to fetch untrusted component definitions or payloads

Tuning Guidance

Baseline expected Langflow custom-component development activity (approved developer accounts, known internal package registries, and CI/CD service accounts) to suppress benign matches. Maintain an allowlist of trusted component/package source domains and tune network-based rules to alert only on connections outside that allowlist. Reduce severity for environments where Langflow is confirmed patched to v1.9.0+ and not internet-exposed, while keeping full severity for internet-facing or unpatched instances per CISA KEV/BOD 26-04 prioritization.

Hunting Queries

Hunts for Langflow-initiated child processes containing encoded commands or embedded URLs, which may indicate delayed or obfuscated exploitation of CVE-2026-0770 that evaded initial detection.

Hunting — KQL
kql 
DeviceProcessEvents
| where InitiatingProcessFolderPath has "langflow"
| where ProcessCommandLine has_any ("http://", "https://", "base64", "-EncodedCommand")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=endpoint parent_process_path="*langflow*" (process="*http://*" OR process="*https://*" OR process="*base64*" OR process="*-EncodedCommand*")
| table _time, host, process_name, process, user
| sort -_time

Atomic Red Team Tests

Test 1 Simulate Langflow custom component remote fetch
linux

Simulates the Langflow process making an outbound connection to an external URL to retrieve custom component code, mimicking the untrusted-control-sphere inclusion behavior of CVE-2026-0770.

Command

bash 
curl -s -o /tmp/langflow_component_test.py https://raw.githubusercontent.com/langflow-ai/langflow/main/README.md

Cleanup

bash 
rm -f /tmp/langflow_component_test.py

Expected Telemetry

Outbound HTTP/S connection from a process associated with the Langflow environment to an external GitHub raw content URL, captured in network/proxy logs.

Expected Detection

elastic_eql and kql network-fetch stages of the correlation rules should flag the outbound connection as originating from a Langflow-associated process to an external non-RFC1918 host.

Test 2 Simulate shell spawn from Langflow parent process
linux

Simulates a Langflow-labeled parent process spawning a bash shell, emulating post-exploitation command execution resulting from untrusted component inclusion.

Command

bash 
python3 -c "import subprocess,os; os.environ['ATOMIC_PARENT']='langflow_test'; subprocess.Popen(['bash','-c','echo cve-2026-0770-lab-test'])"

Cleanup

bash 
unset ATOMIC_PARENT

Expected Telemetry

Process creation event showing a bash child process spawned by a python3 process whose lineage/name references 'langflow', captured via Sysmon/EDR process telemetry.

Expected Detection

kql, spl, qradar_aql, and crowdstrike_cql rules should trigger on the shell child process spawned from the Langflow-associated parent process.

Test 3 Simulate encoded PowerShell execution from Langflow process (Windows)
windows

Simulates a Langflow-related process invoking PowerShell with an encoded command, mimicking obfuscated payload execution following exploitation of the untrusted inclusion vulnerability.

Command

powershell 
powershell.exe -EncodedCommand JABsAGEAbgBnAGYAbABvAHcAIAA9ACAAIgBjAHYAZQAtADIAMAAyADYALQAwADcANwAwACIA

Cleanup

powershell 
N/A - no persistent changes; encoded command only echoes a test string to memory.

Expected Telemetry

Process creation event for powershell.exe with -EncodedCommand flag, ideally spawned by or associated with a process/service named 'langflow', captured in Windows Security/Sysmon Event ID 4688/1.

Expected Detection

Hunting query for encoded PowerShell execution from Langflow-associated parent processes should surface this event; kql detection should match on powershell.exe as a shell/interpreter child.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1195.001Compromise Software Dependencies and Development ToolsT1059.006Python

Same Tactic: Initial Access

Popular Detections