{"slug": "langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now", "title": "Langflow CVE-2026-0768: Attackers Are Stealing Your AI API Keys Right Now", "summary": "Attackers are actively exploiting CVE-2026-0768, a CVSS 9.8 unauthenticated remote code execution vulnerability in Langflow's `/api/v1/validate/code` endpoint, to steal OpenAI, AWS, Anthropic, and GCP API keys from internet-exposed instances, with VulnCheck confirming 50+ Canary detections and 360 total attacks by September 2. Langflow versions up to 1.4.2 are affected, and no patched version exists as of September 9, 2026; CISA's September 2026 KEV batch marks the first time AI/ML components constitute nearly half of new federal patch mandates. JFrog Security Research found that previously \"patched\" versions remained exploitable, and Censys tracks roughly 7,000 internet-facing Langflow deployments, with some researchers estimating 74,000.", "body_md": "Attackers are actively exploiting a critical flaw in Langflow and they are not after your database — they want your OpenAI bill. **CVE-2026-0768**, a CVSS 9.8 unauthenticated remote code execution vulnerability, is being used right now to harvest API keys, cloud credentials, and AI provider tokens from internet-exposed Langflow instances. If your deployment is reachable from the public internet, [treat it as compromised until proven otherwise](https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/).\n\n## What CVE-2026-0768 Actually Does\n\nThe vulnerability lives in Langflow’s custom component editor — specifically the `/api/v1/validate/code` endpoint. This endpoint lets developers test Python snippets before adding them to a flow. The problem: Langflow passes user-supplied input directly to Python’s `exec()` with no sanitization and no authentication check. Anyone on the internet can hit that endpoint with a crafted POST request and execute arbitrary code as root.\n\nThis is not a novel pattern. CVE-2025-3248, disclosed in April 2025, was a different RCE in the same validate endpoint — fixed in Langflow 1.3.0, apparently not far enough. CVE-2026-0768 is a subsequent injection in the same functional area, [affecting all versions up to 1.4.2](https://www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise). JFrog Security Research found that “patched” Langflow versions for related CVEs remained exploitable after fixes shipped. There is a pattern worth taking seriously.\n\n## What Attackers Are Taking\n\nThe exploitation chain is methodical. After gaining root code execution, attackers query environment variables: `OPENAI_API_KEY`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, Anthropic tokens, GCP credentials, and database connection strings. They also read `/root/.cache/langflow/secret_key` and check `.bash_history` for lateral movement.\n\nThis is a cost-shifting attack. Stolen API keys mean the attacker runs LLM workloads on your bill. VulnCheck confirmed 50+ Canary detections, with 360 total attacks observed by September 2. Exploitation escalated from isolated probing in late August to continuous, multi-source scanning — a shift that typically signals the vulnerability has been shared widely across threat actor communities.\n\n## How Many Instances Are Exposed\n\nCensys tracks roughly 7,000 internet-facing Langflow deployments; some researchers put the figure at 74,000. Many run with `LANGFLOW_AUTO_LOGIN=true` — the default — meaning there is no login page at all. Developers routinely spin up Langflow for internal tooling and never restrict network access. The attack surface is not a niche edge case.\n\n## The Broader Problem With AI Dev Frameworks\n\nThis is Langflow’s 12th exploited CVE in 2026. That number is not a coincidence — it reflects a structural problem. AI developer frameworks are built for productivity, not hardening. They store API keys in environment variables because that is the recommended LLM integration pattern. When those tools get deployed internet-facing without a firewall, attackers have a reliable, high-value target: one exploit hands them every AI credential the application uses.\n\n[CISA’s September 2026 KEV batch underscores this shift.](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html) For the first time, AI and ML components — LiteLLM, Starlette, JFrog Artifactory — constitute nearly half of new federal patch mandates. Langflow is not alone. Ollama, Gradio, and Open WebUI have all had similar issues this year.\n\n## What to Do Right Now\n\nThere is no confirmed patched version for CVE-2026-0768 as of September 9, 2026. The vendor advisory with a fixed release has not been published. Mitigation is the only reliable option.\n\n1. **Remove internet access.** Put Langflow behind a VPN or restrict it to your internal network. If the endpoint is unreachable, the exploit is not viable. This is the single most effective control.\n2. **Disable auto-login.** Set`LANGFLOW_AUTO_LOGIN=false` . This forces authentication at the Langflow layer and raises the bar, though it does not fix the underlying flaw.\n3. **Rotate all credentials.** Assume any API keys, AWS secrets, Anthropic tokens, and database strings stored in your Langflow environment have been read. Rotate immediately, regardless of whether you see suspicious activity — attackers in this campaign are operating quietly by design.\n\nMonitor the [official Langflow security advisories](https://github.com/langflow-ai/langflow/security/advisories) for a patched release. When it ships, verify the changelog explicitly confirms CVE-2026-0768 is addressed — given the history here, version number alone is not enough. Read the notes.\n\n*Sources: [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/), [Forkast News](https://forkast.news/langflows-12th-exploited-cve-confirms-ai-frameworks-are-now-credential-harvesting-infrastructure/), [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise), [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html).*", "url": "https://wpnews.pro/news/langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now", "canonical_source": "https://byteiota.com/langflow-cve-2026-0768-rce/", "published_at": "2026-09-09 01:09:32+00:00", "updated_at": "2026-09-09 01:15:40.292805+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "ai-infrastructure"], "entities": ["Langflow", "JFrog Security Research", "VulnCheck", "Censys", "CISA", "OpenAI", "AWS", "Anthropic"], "alternates": {"html": "https://wpnews.pro/news/langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now", "markdown": "https://wpnews.pro/news/langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now.md", "text": "https://wpnews.pro/news/langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now.txt", "jsonld": "https://wpnews.pro/news/langflow-cve-2026-0768-attackers-are-stealing-your-ai-api-keys-right-now.jsonld"}}