Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-0770.
Upgrade to ProDetect Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829) in Microsoft Sentinel
Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let LangflowHosts = dynamic(["langflow", "langflow-server"]);
union isfuzzy=true
(DeviceProcessEvents
| where FolderPath has_any ("langflow") or InitiatingProcessFolderPath has_any ("langflow")
| where InitiatingProcessCommandLine has_any ("custom_component", "import_str", "exec(", "eval(")
| where FileName in~ ("bash", "sh", "powershell.exe", "cmd.exe", "python", "python3", "curl", "wget")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName),
(DeviceNetworkEvents
| where InitiatingProcessFolderPath has "langflow"
| where RemoteUrl has_any ("raw.githubusercontent", "pastebin", "transfer.sh", "http://") or ipv4_is_private(RemoteIP) == false
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, AccountName)
| sort by TimeGenerated descDetects Langflow server processes spawning shell interpreters or scripting engines in conjunction with custom-component/import execution patterns, or Langflow making outbound connections to fetch remote code/component definitions — consistent with CVE-2026-0770 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Langflow custom component development or plugin installation by authorized developers
- Scheduled maintenance scripts that invoke shell utilities from the Langflow service account
- Package manager updates (pip/npm) triggered by legitimate Langflow upgrade workflows
Other platforms for CVE-2026-0770
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Langflow custom component remote fetch
Expected signal: Outbound HTTP/S connection from a process associated with the Langflow environment to an external GitHub raw content URL, captured in network/proxy logs.
- Test 2Simulate shell spawn from Langflow parent process
Expected signal: Process creation event showing a bash child process spawned by a python3 process whose lineage/name references 'langflow', captured via Sysmon/EDR process telemetry.
- Test 3Simulate encoded PowerShell execution from Langflow process (Windows)
Expected signal: Process creation event for powershell.exe with -EncodedCommand flag, ideally spawned by or associated with a process/service named 'langflow', captured in Windows Security/Sysmon Event ID 4688/1.
References (5)
- https://github.com/langflow-ai/langflow/releases/tag/v1.9.0
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-0770
- https://www.exploit-db.com/exploits/52597
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-0770 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month