Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-0770.
Upgrade to ProDetect Langflow Untrusted Code Execution via CVE-2026-0770 (CWE-829) in Splunk
Detects exploitation of CVE-2026-0770, an Inclusion of Functionality from Untrusted Control Sphere vulnerability in Langflow that allows unauthenticated or low-privileged actors to trigger execution of code, components, or custom nodes sourced from an untrusted control sphere. This flaw is listed in CISA KEV with a public exploit-db PoC and is actively exploited. Exploitation typically manifests as unexpected outbound connections from the Langflow host to fetch remote component definitions, followed by anomalous child process spawns from the Langflow server process, or webhook/API calls to Langflow's flow-execution and custom component endpoints from untrusted sources.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
(index=endpoint OR index=sysmon) (process_path="*langflow*" OR parent_process_path="*langflow*")
[ search (process_name IN ("bash","sh","powershell.exe","cmd.exe","python","python3","curl","wget")) OR (process="*exec(*" OR process="*eval(*" OR process="*custom_component*") ]
| eval reason="langflow_untrusted_exec"
| append
[ search index=network sourcetype=stream:http OR sourcetype=zeek_http process_path="*langflow*"
| where NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("172.16.0.0/12", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip)
| eval reason="langflow_remote_fetch" ]
| table _time, host, user, process_name, process, dest_ip, url, reason
| sort -_timeCorrelates process execution from the Langflow service with shell/interpreter spawns tied to custom component or import/exec strings, and outbound HTTP calls originating from Langflow to non-RFC1918 destinations, indicating remote code/component inclusion abuse per CVE-2026-0770.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Internal CI/CD pipelines that build and deploy Langflow custom components
- Data science teams legitimately loading external Python packages via Langflow's component system
- Proxy/network monitoring gaps causing benign internal traffic to appear as external
Other platforms for CVE-2026-0770
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Langflow custom component remote fetch
Expected signal: Outbound HTTP/S connection from a process associated with the Langflow environment to an external GitHub raw content URL, captured in network/proxy logs.
- Test 2Simulate shell spawn from Langflow parent process
Expected signal: Process creation event showing a bash child process spawned by a python3 process whose lineage/name references 'langflow', captured via Sysmon/EDR process telemetry.
- Test 3Simulate encoded PowerShell execution from Langflow process (Windows)
Expected signal: Process creation event for powershell.exe with -EncodedCommand flag, ideally spawned by or associated with a process/service named 'langflow', captured in Windows Security/Sysmon Event ID 4688/1.
References (5)
- https://github.com/langflow-ai/langflow/releases/tag/v1.9.0
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-0770
- https://www.exploit-db.com/exploits/52597
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-0770 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month