Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability tracked as CVE-2026-0768 in Langflow, an open-source framework used for building AI applications. The exploitation allows attackers to steal sensitive credentials, tokens, and API keys including those for OpenAI and AWS. The vulnerability requires no authentication, making it particularly dangerous for exposed instances. Langflow is widely used in the AI development community, increasing the potential attack surface. Organizations using Langflow are urged to patch immediately and rotate any exposed credentials. The active exploitation status elevates the severity of this vulnerability significantly.
CVE-2026-0768 is a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, an open-source Python-based low-code platform for building AI applications. The flaw resides in the code validator of Langflow's custom component editor. Specifically, it results from the lack of proper validation of a user-supplied string in the 'code' parameter provided to the validate endpoint before using it to execute Python code. Exploitation allows arbitrary code execution without authentication and with root privileges. VulnCheck detected active exploitation on UK-based honeypots, recording at least 50 exploitation attempts over the weekend and 360 total as of reporting. Attack traffic originated primarily from Russia. Attackers conduct reconnaissance by querying environment variables including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size. Goals include harvesting Langflow admin credentials, OpenAI API keys, and AWS secrets. No public proof-of-concept (PoC) exploit was known at time of reporting. This is one of multiple Langflow CVEs exploited in 2026; others include CVE-2026-33017 (critical code injection), CVE-2026-5027 (arbitrary file write/path traversal), CVE-2026-55255 (auth bypass accessing other users' workflows and delivering second-stage implants), CVE-2026-0770 (RCE with root privileges, malware deployment, cloud credential extraction), and CVE-2026-9198 (exploited after public PoCs became available).
Upgrade Langflow to the latest available version 1.11.6, which addresses all known vulnerabilities including CVE-2026-0768. Monitor environment variable access patterns and file system access to sensitive paths such as /root/.cache/langflow/secret_key, .ssh, and .bash_history. Monitor network traffic for suspicious requests to the Langflow validate endpoint. Rotate any potentially exposed credentials including Langflow superuser passwords, OpenAI API keys, and AWS access/secret keys if the instance may have been compromised. Restrict public internet access to Langflow instances where possible and enforce authentication. Review logs for exploitation indicators including unusual queries for environment variables matching LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*.
Query for environment variable LANGFLOW_SUPERUSER, Query for environment variable OPENAI_API*, Query for environment variable AWS_ACCESS*, Query for environment variable AWS_SECRET*, Access to /root/.cache/langflow/secret_key, Access to .ssh directory, Access to .bash_history, Exploitation attempts targeting Langflow /validate endpoint, Attack traffic originating from Russian IP addresses
