CISA orders urgent action on Langflow RCE and auth flaws

The Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to prioritize patching an actively exploited vulnerability in the Langflow visual framework for building AI agents, specifically CVE-2026-0770, which allows unauthenticated threat actors to gain remote code execution as root in low-complexity attacks. The malicious activity targeting this flaw is not limited to vulnerability checks, with attempts also observed attempting to deploy malware and obtain AWS credentials, environment variables, and container metadata. Most activity involved command-execution checks or system reconnaissance, while KEVIntel reported observing attempts to download second-stage scripts and access cloud metadata and credential files. As a result of CISA's alert, U.S. Federal Civilian Executive Branch (FCEB) agencies are required to secure their systems by Friday, with the agency warning that this type of vulnerability poses significant risks to the federal enterprise.