Deserialization RCE in Langflow Disk Cache Requires Authentication

Publication date: 2026-01-23

Last updated on: 2026-02-18

Assigner: Zero Day Initiative

Description

Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27919.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-23

Last Modified

2026-02-18

Generated

2026-07-06

AI Q&A

2026-01-23

EPSS Evaluated

2026-07-04

NVD

CVE-2026-0772

EUVD

EUVD-2026-4467

Affected Vendors & Products

Vendor	Product	Version / Range
langflow	langflow	1.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability in Langflow's disk cache service occurs because the software does not properly validate user-supplied data, leading to deserialization of untrusted data. An attacker who is authenticated can exploit this flaw to execute arbitrary code remotely with the privileges of the service account running the disk cache service. [1]

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary code on the affected system remotely, potentially leading to full compromise of the service running Langflow. This could result in unauthorized actions, data manipulation, or further attacks within the environment. [1]

Hi! I’m here to help you understand CVE-2026-0772. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70