Langflow CVE-2026-0768 Unauthenticated RCE via validate/code API

Ankit Mehta@Secvyn

•updated Sep 25, 2026•0•0•1

Detects an unauthenticated remote code execution (RCE) attempt against Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing code execution patterns such as eval, exec, os.system, or subprocess, indicating an attacker attempting to leverage the vulnerability to execute arbitrary commands.