Threat actors are actively exploiting a critical, unauthenticated remote code execution vulnerability, tracked as CVE-2026-0768, in Langflow, an open-source framework used to build artificial intelligence applications. The attacks are being used to steal credentials, authentication tokens, cloud secrets, and API keys.
The security flaw affects Langflow’s custom component editor and resides in its code validation functionality. Because the vulnerability does not require authentication, attackers can remotely execute arbitrary Python code on exposed Langflow servers.
Threat intelligence company VulnCheck discovered exploitation attempts against a honeypot in the United Kingdom. The system recorded at least 50 attacks over a single weekend, with most malicious traffic originating from Russia.
Caitlin Condon, principal security researcher at VulnCheck, said attack activity continues to increase. The total number of observed exploitation attempts had reached 360 at the time of reporting.
According to Condon, attackers are conducting reconnaissance and querying environment variables to obtain Langflow administrator credentials, superuser authentication keys, AWS access keys, AWS secret keys, and OpenAI API keys.
“The attacker’s requests include, among other things, querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, checking .ssh access and .bash_history size,” Condon explained.
Langflow is a Python-based, open-source, low-code platform for developing AI applications, autonomous agents, chatbots, and retrieval-augmented generation (RAG) systems.
The platform allows users to build workflows through a graphical interface by connecting language models, prompts, databases, APIs, and other software components.
CVE-2026-0768 was disclosed in January and affects Langflow versions 1.4.2 and earlier. The critical vulnerability allows unauthenticated attackers to execute arbitrary code with root privileges.
According to the National Vulnerability Database, the flaw is caused by improper validation of user-controlled code parameters sent to a validation endpoint. The supplied string is executed as Python code without adequate security checks.
Trend Micro’s Zero Day Initiative similarly noted that user-provided input is not properly validated before being executed by the affected endpoint.
Condon said that no publicly available proof-of-concept exploit has been identified so far. However, active attacks demonstrate that threat actors are already capable of weaponizing the vulnerability against internet-exposed Langflow deployments.
CVE-2026-0768 is not the first Langflow vulnerability to be exploited in the wild this year. In March, attackers began exploiting CVE-2026-33017, a critical code injection vulnerability, roughly one day after its disclosure. The attacks allowed threat actors to execute Python scripts and retrieve .env files and database data.
Subsequent attacks targeted CVE-2026-5027 to write arbitrary files to vulnerable servers and CVE-2026-55255 to access other users’ AI workflows, steal sensitive information, and deploy second-stage malware.
Attackers also attempted to exploit CVE-2026-0770 to execute commands with root privileges and deploy malware designed to harvest cloud credentials, environment variables, and container metadata.
Most recently, CISA warned that CVE-2026-9198 was being exploited after several proof-of-concept exploits became publicly available.
Organizations using Langflow should immediately upgrade to the latest available release, version 1.11.6, which addresses the known vulnerabilities. Administrators should also rotate exposed AWS credentials, OpenAI API keys, Langflow secrets, and other authentication tokens, while reviewing server logs for signs of unauthorized access.
<p>The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.</p><p>The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.</p>
<a class="article-link" href="https://hubs.li/Q04sB3fb0" target="_blank" rel="noopener nofollow">Get the report</a>
</div>Source: www.bleepingcomputer.com