CVE-2026-7700: Langflow-AI Langflow RCE Vulnerability

CVE-2026-7700 Overview

CVE-2026-7700 is a code injection vulnerability affecting langflow-ai langflow versions up to and including 1.8.4. The flaw resides in the eval function within src/lfx/src/lfx/components/llm_operations/lambda_filter.p, part of the LambdaFilterComponent. An authenticated remote attacker can manipulate input passed to the component to inject and execute arbitrary code. A public exploit proof-of-concept is available, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact

Authenticated remote attackers can inject code into the Langflow LambdaFilterComponent, leading to execution within the application context.

Affected Products

• langflow-ai langflow versions through 1.8.4
• Component: LambdaFilterComponent
• File: src/lfx/src/lfx/components/llm_operations/lambda_filter.p

Discovery Timeline

• 2026-05-03 - CVE-2026-7700 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7700

Vulnerability Analysis

Langflow is a visual framework for building applications backed by large language models (LLMs). The LambdaFilterComponent allows users to define filter logic that is evaluated dynamically by the Python eval function. Because user-supplied content reaches eval without adequate sanitization, attackers can submit a crafted lambda expression that escapes the intended filtering context. The injected expression executes in the same Python interpreter that runs Langflow, granting access to imported modules and runtime objects.

The issue maps to [CWE-74], where untrusted input flows into a downstream interpreter without neutralization of special elements. The EPSS estimate for this CVE is 0.041% at the 12.318 percentile, reflecting low predicted exploitation probability despite a public proof of concept.

Root Cause

The root cause is the use of Python's eval to process expressions defined in the LambdaFilterComponent workflow. The component does not constrain the executable namespace nor parse the lambda string with a restricted abstract syntax tree (AST). Any caller permitted to construct or modify a flow can introduce expressions that perform actions beyond the intended filtering operation.

Attack Vector

Exploitation requires network access to a Langflow instance and a low-privileged authenticated session that can edit or execute flows containing the LambdaFilterComponent. The attacker submits a malicious lambda expression as the filter parameter. When the component is evaluated, the payload runs inside the Langflow process. A public technical writeup with proof-of-concept details is published in the Yuque vulnerability analysis.

// Example exploitation code (sanitized)
// No verified exploit code is reproduced here. Refer to the linked
// Yuque writeup and VulDB entry 360869 for proof-of-concept details.

Detection Methods for CVE-2026-7700

Indicators of Compromise

• Unexpected child processes spawned by the Langflow server process, especially shells or interpreters such as sh, bash, or python.
• Outbound network connections initiated by the Langflow process to unknown hosts following flow execution.
• Modifications to flows that introduce LambdaFilterComponent instances containing dunder attributes such as __import__, __builtins__, or __class__.

Detection Strategies

• Inspect Langflow flow definitions and audit logs for lambda expressions referencing os, subprocess, eval, exec, or __import__.
• Hook or instrument calls to eval within the Langflow runtime and log the evaluated string for review.
• Correlate authentication logs with flow editing events to identify low-privileged accounts introducing new LambdaFilterComponent nodes.

Monitoring Recommendations

• Enable application-level logging for component execution and forward events to a centralized analytics pipeline.
• Monitor host telemetry on Langflow servers for anomalous process trees and file system writes outside the application directory.
• Track egress traffic from Langflow workloads and alert on connections to non-allowlisted destinations.

How to Mitigate CVE-2026-7700

Immediate Actions Required

• Restrict network access to Langflow management interfaces using firewall rules or a reverse proxy with authentication.
• Limit which user roles can create or modify flows that include the LambdaFilterComponent.
• Review existing flows for suspicious lambda expressions and remove any unauthorized modifications.

Patch Information

No vendor patch was identified at the time of publication. The vendor did not respond to disclosure attempts. Track the VulDB entry 360869 and the Langflow GitHub repository for fixes beyond version 1.8.4.

Workarounds

• Disable or remove the LambdaFilterComponent from available components if your deployment does not require it.
• Run Langflow inside a container or sandbox with no outbound internet access and a non-root user.
• Replace dynamic eval-based filters with explicit, parameterized filter components that do not interpret arbitrary code.
• Apply principle of least privilege so the Langflow process cannot read sensitive secrets or modify host files.

# Configuration example
# Run Langflow as a non-root user inside a restricted container
docker run --rm \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --network=langflow_internal \
  -p 127.0.0.1:7860:7860 \
  langflowai/langflow:latest