29MAY

Langflow hits KEV a second time

1 min read

14:17UTC

CISA listed a second Langflow flaw, CVE-2026-0770, on 21 July, two months after Iran-nexus MuddyWater exploited the framework's first catalogued bug.

← Back to GitHub's own code cloned via VS Code add-on Jump to analysis ↓

TechnologyAssessed

Key takeaway

A second Langflow KEV entry in two months shows AI-agent frameworks drawing repeat exploitation.

CISA added a second Langflow flaw, CVE-2026-0770, to its catalogue of Known Exploited Vulnerabilities (KEV) on 21 July, and set federal agencies a 24 July deadline to patch. Langflow is an open-source framework for building large-language-model (LLM) and agent-orchestration applications, the software layer that wires AI models into automated workflows.

The first Langflow entry, CVE-2025-34291, reached the catalogue on 21 May after Iran-nexus actor MuddyWater exploited it. Two listings for one agent-orchestration framework inside two months put it on the record as a recurring exploitation surface rather than a single incident.

Buyers standing up agent frameworks now inherit the patch-velocity problem that edge appliances have carried for years. Each new AI-application layer adds internet-facing code that attackers probe as fast as vendors and CISA can list the results, and Langflow is the first such framework to earn a repeat entry.

Deep Analysis

In plain English

Langflow is free, open-source software that lets developers build AI chatbot and agent pipelines by dragging and connecting blocks instead of writing code from scratch. Because it often stores passwords and access keys for other services it connects to, a security flaw in Langflow can give an attacker access well beyond Langflow itself. On 21 July, CISA added a second Langflow flaw, CVE-2026-0770, to its list of vulnerabilities under active attack, giving US federal agencies until 24 July to fix it. This is the second Langflow flaw added to that list within two months, a fast repeat for one piece of software.

Deep Analysis

Root Causes

Langflow's structural exposure comes from its role as an orchestration layer: because it stores API tokens and credentials for every downstream service a pipeline connects to, a single flaw gives an attacker a pivot point reaching every service the pipeline touches, well beyond the Langflow instance itself.

A second KEV entry within two months suggests the codebase's attack surface, built for rapid feature delivery in a fast-moving open-source AI tooling project, has not yet had the multiple rounds of hardening review that longer-established infrastructure software has undergone.

Escalation

No threat actor has yet been publicly attributed to CVE-2026-0770, unlike Langflow's first KEV entry which was tied to MuddyWater.

What could happen next?

Risk
Langflow's second KEV entry in two months marks it as a recurring exploitation surface rather than a one-off flaw, raising the odds of a third entry if the underlying hardening gap is not addressed.
Consequence
Organisations running Langflow now face two separate federal-deadline patch cycles within two months, straining the same patching resources used for other KEV entries in this fortnight's batch.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: CitrixBleed in 2023 showed that once a piece of infrastructure software becomes a known target, attackers return to it: NetScaler devices carried a second wave of exploitation months after the original session-hijacking flaw was patched. Langflow's second KEV entry, CVE-2026-0770, arriving two months after its first, follows the same return-to-target pattern for AI-agent-orchestration software rather than network appliances.

Counter-parallel: Unlike CitrixBleed, where both waves were financially motivated ransomware activity, Langflow's first KEV entry was exploited by Iran-nexus actor MuddyWater rather than a ransomware crew, so the second entry may reflect a different actor population finding the same high-value pivot point rather than the same group returning.

Sources:CISA

Mentions:CISA →MuddyWater →Known Exploited Vulnerabilities →CVE-2025-34291 →Iran →Langflow →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Causes and effects

Caused by

AI orchestration flaw joins CISA's KEV

Langflow's first KEV entry, exploited by Iran-nexus MuddyWater, is escalated by the second entry two months later, making the framework a recurring exploitation surface.

Occurred 21 May 2026

Read story →

This Event

Langflow hits KEV a second time

A second exploited-vulnerabilities entry in two months puts AI-agent-orchestration software on the recurring-exploitation trajectory long familiar from edge appliances.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.