Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-0770.
Upgrade to ProDetect Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829) in Elastic Security
Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
sequence by host.name with maxspan=5m
[network where process.executable : "*langflow*" and
not cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")]
[process where event.type == "start" and
process.parent.executable : "*langflow*" and
process.name : ("bash", "sh", "python*", "powershell.exe", "cmd.exe", "curl", "wget")]Sequences an outbound network connection from the Langflow process to an external host followed within 5 minutes by a shell or interpreter process spawned by Langflow, consistent with fetching and executing untrusted component code.
Data Sources
Required Tables
False Positives & Tuning
- Authorized developers pulling and testing external Langflow flow templates
- Legitimate outbound calls to package registries during approved dependency updates
- Automated integration tests exercising Langflow's component-loading API
Other platforms for CVE-2026-0770
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Langflow custom component remote fetch
Expected signal: Outbound HTTP/S connection from a process associated with the Langflow environment to an external GitHub raw content URL, captured in network/proxy logs.
- Test 2Simulate shell spawn from Langflow parent process
Expected signal: Process creation event showing a bash child process spawned by a python3 process whose lineage/name references 'langflow', captured via Sysmon/EDR process telemetry.
- Test 3Simulate encoded PowerShell execution from Langflow process (Windows)
Expected signal: Process creation event for powershell.exe with -EncodedCommand flag, ideally spawned by or associated with a process/service named 'langflow', captured in Windows Security/Sysmon Event ID 4688/1.
References (5)
- https://github.com/langflow-ai/langflow/releases/tag/v1.9.0
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-0770
- https://www.exploit-db.com/exploits/52597
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-0770 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month