Federal Directive: CISA Expands KEV Catalog with Critical Langflow and DD-WRT Vulnerabilities
Executive Summary
The Cybersecurity and Infrastructure Security Agency (CISA) has formally expanded its Known Exploited Vulnerabilities (KEV) catalog, adding two critical vulnerabilities actively weaponized by threat actors in real-world intrusion campaigns. The new additions include a high-severity remote code execution flaw in the Langflow AI framework (CVE-2026-0770) and a legacy stack-based buffer overflow in DD-WRT router firmware (CVE-2021-27137). Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are mandated to remediate or disconnect affected systems immediately.
Technical Deep-Dive into the Newly Added Flaws
The two additions span both cutting-edge artificial intelligence infrastructure and legacy networking equipment:
1. Langflow Untrusted Control Sphere Code Execution (CVE-2026-0770)
* Vulnerability Class: Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
* Technical Mechanics: Langflow, a widely used open-source visual orchestration framework for Large Language Model (LLM) agents, contains a flaw in its component loading pipeline. Unauthenticated remote attackers can send crafted JSON execution graphs containing unauthorized component imports, forcing the backend server to load and execute untrusted Python code.
* Impact: Unauthenticated Remote Code Execution (RCE) on AI orchestration servers, enabling immediate credential harvesting and cloud API key theft.
2. DD-WRT Stack-Based Buffer Overflow (CVE-2021-27137)
* Vulnerability Class: Stack-based Buffer Overflow (CWE-121)
* Technical Mechanics: The HTTP management daemon in DD-WRT wireless router firmware fails to properly validate the length of incoming HTTP request parameters during session initialization. An attacker on the local network or WAN interface can transmit a malformed request that overwrites the stack memory, triggering a system crash or arbitrary shell execution under root privileges.
* Impact: Full device takeover of small-office and edge networking hardware.
Directive Component
Requirement Detail
Advisory Agency
CISA (Cybersecurity and Infrastructure Security Agency)
Catalog Action
KEV Catalog Addition under BOD 26-04
Added Flaws
CVE-2026-0770 (Langflow RCE) & CVE-2021-27137 (DD-WRT Overflow)
Federal Remediation Deadline
Immediate Action Required
Strategic Importance of CISA KEV Directives
CISA's KEV catalog serves as the authoritative benchmark for threat-informed vulnerability management across federal government networks and private enterprise SOCs. By cataloging bugs based on confirmed, active exploitation rather than theoretical CVSS scores, CISA forces organizations to prioritize fixing the small percentage of vulnerabilities that drive real-world intrusions.
The inclusion of an AI orchestration flaw (Langflow) alongside a hardware router bug (DD-WRT) reflects the modern threat landscape, where attackers simultaneously exploit emerging AI pipelines and unpatched edge network infrastructure.
Recommendations and Mitigations
Organizations must take immediate steps to remediate these actively exploited vulnerabilities:
1. Update Langflow Orchestration Servers: Immediately upgrade all Langflow deployments to version 1.2.0 or higher, ensuring the untrusted module importer is fully disabled.
2. Restrict Access to AI Framework Portals: Never expose Langflow web interfaces or API endpoints directly to the public internet. Place AI development platforms behind Zero Trust Network Access (ZTNA) or VPN proxies.
3. Patch or Replace DD-WRT Hardware: Flash affected DD-WRT router devices with updated, vendor-supported firmware builds, or replace end-of-life edge devices that can no longer receive vendor patches.
4. Enforce Vulnerability Management Automation: Automate asset discovery tools to continuously map external attack surfaces against CISA KEV additions in real time.