Unauthenticated Python code injection in Langflow validate endpoint executes as root (CVE-2026-0768)
VulnCheck canary sensors recorded exploitation attempts on 2026-08-29 and again today, so internet-reachable Langflow instances are being actively probed and an unpatched, exposed server can be fully compromised as root.
Langflow's validate endpoint executes the user-supplied 'code' parameter as Python without validation or authentication, letting a remote attacker run arbitrary code in the context of root (ZDI-CAN-27322, CVSS 9.8). Version 1.4.2 is confirmed affected.
Affected: Langflow 1.4.2
How to Test
Confirm whether your deployment runs Langflow 1.4.2 and whether its API is reachable from the internet. Review web server or reverse-proxy logs for unauthenticated POST requests to the validate endpoint carrying a 'code' parameter, and inspect the host for unexpected processes or files created by the Langflow (root) user.
How to Mitigate
No fixed release is identified in the available data: immediately remove Langflow from direct internet exposure, place it behind an authenticating reverse proxy or VPN, and restrict network access to the validate endpoint until the vendor publishes a fix; treat any exposed 1.4.2 instance as potentially compromised and investigate before continuing to use it.