Cyber Threat Brief — July 22 2026
⚠️ This report is AI-generated. Always validate findings.
1. Langflow Pre-Auth RCE via validate_code() — CVE-2026-0770
TL;DR: CISA added Langflow CVE-2026-0770 to KEV July 21. Unauthenticated RCE via exec() in the /api/v1/validate/code endpoint — Langflow’s 4th exploited-ITW RCE of 2026. Multiple public PoCs and a Nuclei template are live.
What’s New:
- CISA KEV addition July 21; classified as “Inclusion of Functionality from Untrusted Control Sphere”
validate_code()parses user-supplied code and executes function definitions viaexec()withexec_globalscontainingimportliband full Python builtins- Attackers import
os/subprocess/socketto execute arbitrary system commands as root AUTO_LOGIN=true(default) with default credentials enables full unauthenticated exploitation- Multiple public PoCs on GitHub (affix, diamorphine666, 0xgh057r3c0n) and Exploit-DB (#52597)
- Nuclei template available:
http/cves/2026/CVE-2026-0770.yaml
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /api/v1/validate/code with exec_globals | Exploitation endpoint | T1190 | Reverse proxy / WAF logs | Block unauthenticated POST to /api/v1/validate/code |
importlib, subprocess, os in code parameter | RCE payload indicators | T1059.006 | Application logs | Alert on dangerous module imports in validate requests |
| Langflow process spawning shell children | Post-exploitation | T1059.004 | Sysmon / auditd | Monitor for sh/bash/python children of Langflow process |
Nuclei template CVE-2026-0770.yaml | Scanner artifact | T1595.002 | WAF / IDS | Signature for automated scanning activity |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Suspicious Process Spawned by Web Server (generic) | No Langflow-specific rule for validate_code endpoint abuse |
| Elastic | Linux Suspicious Child Process From Web Server (generic) | No rule targeting Langflow exec_globals injection |
| Sigma | proc_creation_lnx_susp_child_process_from_web_server.yml (generic) | No Langflow-specific variant; need URI + exec_globals content inspection |
Sources: CISA KEV July 21, GitHub Advisory GHSA-g22f-v6f7-2hrh, Exploit-DB #52597, Nuclei Template
Status Updates
- CVE-2026-63030/60137 (WordPress wp2shell): CISA KEV addition July 21. Mass exploitation ongoing — 35 attempts across 13 IPs from 7 countries per KEVIntel. Webshells in
/wp-content/cache/. Update to 6.9.5/7.0.2. Original brief. - CVE-2026-6875 (ServiceNow AI Platform): Exploitation ongoing since July 18. Fortune 500 and critical infrastructure victims confirmed. Second sandbox-escape gadget chain bypasses original PoC defenses. ServiceNow statement July 20 confirms self-hosted patch availability. Original brief.
- CVE-2021-27137 (DD-WRT): Legacy 2021 CVE added to CISA KEV July 21. Stack-based buffer overflow in UPnP
ssdp_msearch. Exploited by C0XMO botnet. Confirm UPnP disabled on DD-WRT devices.