CVE-2026-0772: 
Homebrew vulnerability analysis and mitigation

CVE-2026-0772 is a deserialization of untrusted data vulnerability in Langflow's disk cache service that allows authenticated remote attackers to execute arbitrary code. The vulnerability was reported to the vendor on August 21, 2025, and publicly disclosed as a 0-day advisory on January 9, 2026, after the vendor failed to respond adequately. The only confirmed affected version is Langflow 1.5.0-dev2. It carries a CVSS v3.0 base score of 7.5 (High), assigned by the Zero Day Initiative (ZDI Advisory).

The root cause is improper validation of user-supplied data within Langflow's disk cache service, classified as CWE-502 (Deserialization of Untrusted Data). When the disk cache service processes user-controlled input, it deserializes the data without adequate sanitization or type checking, enabling an attacker to craft a malicious serialized payload that triggers arbitrary code execution upon deserialization. Exploitation requires authentication (low-privilege credentials) and has high attack complexity, suggesting some preconditions such as specific cache interaction patterns must be met. The vulnerability was internally tracked as ZDI-CAN-27919 and discovered by Peter Girnus (@gothburz) and Brandon Niemczyk of Trend Zero Day Initiative (ZDI Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary code in the context of the Langflow service account, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive data processed by the AI workflow platform, tamper with pipeline configurations or outputs, disrupt service availability, and potentially use the compromised service account as a pivot point for lateral movement within the hosting environment (ZDI Advisory).

The vulnerability was published as a 0-day advisory on January 9, 2026, meaning no vendor patch existed at the time of disclosure. ZDI listed an exploit reference associated with this advisory, and a GitHub exploit entry (360E931F-6BAA-5EF5-B37A-369E51501924) was subsequently indexed. The EPSS score is approximately 1.06%, indicating a relatively low but non-negligible probability of exploitation in the near term. No CISA KEV catalog listing or confirmed in-the-wild exploitation by named threat actors has been reported as of available data (ZDI Advisory, Feedly).

1. Reconnaissance: Identify Langflow instances exposed to the network, particularly version 1.5.0-dev2, using service fingerprinting tools such as Shodan or Censys targeting Langflow's default port and API endpoints.
2. Obtain credentials: Acquire valid low-privilege user credentials for the target Langflow instance through phishing, credential stuffing, or other means, as authentication is required.
3. Identify disk cache interaction endpoint: Locate the API endpoint or functionality that interacts with Langflow's disk cache service, which processes and stores serialized data.
4. Craft malicious serialized payload: Construct a malicious Python pickle or equivalent serialized object payload (common in Python-based AI frameworks) that encodes arbitrary OS commands or a reverse shell.
5. Submit payload: Authenticate to the Langflow instance and submit the crafted serialized payload via the vulnerable disk cache service endpoint.
6. Achieve code execution: The server deserializes the untrusted payload, executing the embedded commands in the context of the Langflow service account, granting the attacker a shell or persistent access (ZDI Advisory).

• Network: Unusual outbound connections from the Langflow server process to external IPs or C2 infrastructure; unexpected DNS lookups originating from the Langflow service account.
• Logs: Langflow application logs showing abnormal cache read/write operations with oversized or binary-encoded payloads; authentication events from unfamiliar IP addresses or user agents.
• File System: Unexpected files written to the Langflow cache directory or temp directories; new scripts, binaries, or web shells placed in the application directory by the service account.
• Process: Unusual child processes spawned by the Langflow Python process (e.g., bash, sh, curl, wget, python -c); unexpected cron jobs or scheduled tasks created under the service account.

As of the advisory publication date, no vendor patch had been released despite ZDI's coordinated disclosure timeline spanning from August 2025 through January 2026. The Zero Day Initiative's only recommended mitigation is to restrict network access to Langflow instances — limiting exposure to trusted users and networks only. Organizations should avoid exposing Langflow (especially pre-release or development versions such as 1.5.0-dev2) to untrusted networks, enforce strong authentication controls, and monitor for a vendor-issued patch. Users should follow Langflow's GitHub repository for any security updates (ZDI Advisory).

The vulnerability attracted attention from security community aggregators including Loginsoft's weekly threat report, which highlighted it among high-impact cyber threats of the week. The Hacker Wire also noted the disclosure on social media. The case drew scrutiny due to ZDI's decision to publish as a 0-day after the vendor failed to respond to multiple follow-up requests over nearly five months, underscoring concerns about vendor responsiveness in the AI/ML tooling ecosystem (Loginsoft Report, ZDI Advisory).