Security • 4 min read
Attackers are exploiting a critical Langflow RCE flaw to harvest OpenAI, AWS and administrator credentials from exposed deployments.
Image: BleepingComputer Attackers are exploiting a critical unauthenticated remote-code-execution flaw in Langflow to extract OpenAI API keys, AWS credentials and administrator secrets from exposed installations. The activity targets CVE-2026-0768, a vulnerability in the Python code validator used by Langflow’s custom-component editor.
VulnCheck observed at least 50 exploitation attempts against its U.K. honeypots over a weekend, with most of the attack traffic originating from Russia. Caitlin Condon, the company’s lead security researcher, said the number of observed attacks had risen to 360. The activity does not depend on a public proof-of-concept exploit: Condon said there are currently no known public PoCs for CVE-2026-0768.
The vulnerability was disclosed in January and affects Langflow 1.4.2 and earlier. Exploitation does not require authentication and can provide code execution with root privileges.
“Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API
, AWS_ACCESS, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size,”
The CVE-2026-0768 vulnerability description identifies the vulnerable validate
endpoint as the entry point. Langflow fails to properly validate a user-supplied string in the endpoint’s code
parameter before passing it to Python for execution. An attacker can submit code through the validation path without first authenticating to the application.
A compromised Langflow process can be used to inspect its runtime environment, retrieve application secrets and search for credentials that provide access to external services. The variables observed by VulnCheck include Langflow’s superuser credentials, OpenAI API keys and AWS access and secret keys. Probing /root/.cache/langflow/secret_key
, SSH access and shell history also indicates that attackers are checking whether the host can provide additional paths into the surrounding environment.
Langflow’s attack surface #
Langflow is an open-source, Python-based low-code platform for assembling AI agents, chatbots and retrieval-augmented-generation systems. Its visual editor connects language models, prompts, databases, APIs and other tools, while its source-code access lets developers customize components with Python. User-supplied Python is part of the product’s authoring model, but it must not be treated as trusted code when it reaches a remotely accessible endpoint.
The project’s official GitHub repository documents several deployment paths, including a local Python installation, Docker and Langflow Desktop for Windows and macOS. The quickstart runs the service at http://127.0.0.1:7860
, while the documented Docker command publishes port 7860
through docker run -p 7860:7860 langflowai/langflow:latest
. A deployment bound only to loopback differs from one exposed through a public interface, but the supplied reporting does not establish how many internet-facing Langflow instances are vulnerable.
The repository also describes built-in API and MCP servers, API and JSON export, multi-agent orchestration, vector-database support and integrations with observability tools including LangSmith and LangFuse. Those capabilities may make more infrastructure and credentials reachable from a compromised workflow host; they do not, by themselves, prove that any specific integration was accessed in this campaign.
The relevant version history, including earlier Langflow flaws mentioned in the reporting, is:
| Time or release | Security event or status |
|---|---|
| January | CVE-2026-0768 disclosed; Langflow 1.4.2 and earlier affected |
| March | CVE-2026-33017 exploited about a day after disclosure to run Python scripts and harvest .ENV and database files |
| 2026 | CVE-2026-5027 used to write arbitrary files; CVE-2026-55255 used to access other users' workflows and deliver second-stage implants |
| 2026 | CVE-2026-0770 exploited for root-level command execution and attempted malware and cloud-credential theft |
| 2026 | CISA warned that CVE-2026-9198 was being exploited after public PoCs appeared |
| 1.11.6 | Version recommended by Langflow for addressing all known flaws cited in the reporting |
CVE-2026-0768 is part of a series of Langflow vulnerabilities used for code execution, file modification, workflow access, data theft and credential extraction during 2026. The reporting says CVE-2026-33017 was exploited within about a day of disclosure, while the current campaign has no known public PoC.
What Langflow operators should do #
Operators running 1.4.2 or earlier should upgrade to Langflow 1.11.6, the version identified in the reporting as addressing all known flaws in the tool. They should also treat any exposed instance as potentially compromised rather than assuming an upgrade alone invalidates stolen credentials.
The credentials specifically targeted in the observed requests are LANGFLOW_SUPERUSER
, OPENAI_API*
, AWS_ACCESS*
and AWS_SECRET*
. Incident response should include reviewing and rotating Langflow administrator credentials, OpenAI API keys and AWS access credentials if the vulnerable service was reachable by an attacker. The source material does not provide a confirmed compromise count, a list of affected organizations or evidence that every observed request successfully extracted a secret, so those details remain unresolved.
The GitHub project’s installation guidance requires Python 3.10–3.14 and recommends uv
for local installation. It also supports Docker and a desktop package with bundled dependencies. Those options simplify deployment, but they do not remove the need to control network exposure: the flaw is in an application endpoint, not in a package-installation mechanism. Langflow combines arbitrary Python customization, external model APIs, cloud credentials and deployable API or MCP interfaces in one service. A remotely reachable validator that executes input without authentication can turn that service into a credential-harvesting foothold before defenders inspect the workflow itself.
Frequently asked questions #
Which Langflow versions are affected by CVE-2026-0768?+ #
Langflow versions 1.4.2 and earlier are affected by the unauthenticated remote-code-execution flaw.
What Langflow version should users install?+ #
The reporting recommends upgrading to Langflow 1.11.6, which addresses all known flaws cited in the report.
Which credentials are attackers targeting?+ #
Observed requests searched for Langflow administrator credentials, OpenAI API keys, AWS access and secret keys, cached Langflow secrets, SSH access and shell history.
Is there a public exploit for CVE-2026-0768?+ #
No known public proof-of-concept exploit has been reported, although VulnCheck observed active exploitation attempts.
Sophia Reynolds Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.