{"slug": "langflow-flaw-is-now-stealing-openai-and-aws-keys", "title": "Langflow flaw is now stealing OpenAI and AWS keys", "summary": "Attackers are exploiting a critical unauthenticated remote-code-execution flaw in Langflow, tracked as CVE-2026-0768, to steal OpenAI API keys, AWS credentials, and administrator secrets from exposed deployments. VulnCheck observed at least 360 exploitation attempts against its U.K. honeypots, with most traffic originating from Russia, and no public proof-of-concept exists. The vulnerability affects Langflow 1.4.2 and earlier and allows code execution with root privileges.", "body_md": "[Security](/security/)\n\n• 4 min read\n\n# Langflow flaw is now stealing OpenAI and AWS keys\n\nAttackers are exploiting a critical Langflow RCE flaw to harvest OpenAI, AWS and administrator credentials from exposed deployments.\n\nImage: [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/)\n\nAttackers are exploiting a **critical unauthenticated remote-code-execution flaw in Langflow** to extract OpenAI API keys, AWS credentials and administrator secrets from exposed installations. The activity targets **CVE-2026-0768**, a vulnerability in the Python code validator used by Langflow’s custom-component editor.\n\nVulnCheck observed at least 50 exploitation attempts against its U.K. honeypots over a weekend, with most of the attack traffic originating from Russia. Caitlin Condon, the company’s lead security researcher, said the number of observed attacks had risen to **360**. The activity does not depend on a public proof-of-concept exploit: Condon said there are currently no known public PoCs for CVE-2026-0768.\n\nThe vulnerability was disclosed in **January** and affects Langflow **1.4.2 and earlier**. Exploitation does not require authentication and can provide code execution with root privileges.\n\n“Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API\n\n, AWS_ACCESS, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size,”\n\nThe [CVE-2026-0768 vulnerability description](https://nvd.nist.gov/vuln/detail/cve-2026-0768) identifies the vulnerable `validate`\n\nendpoint as the entry point. Langflow fails to properly validate a user-supplied string in the endpoint’s `code`\n\nparameter before passing it to Python for execution. An attacker can submit code through the validation path without first authenticating to the application.\n\nA compromised Langflow process can be used to inspect its runtime environment, retrieve application secrets and search for credentials that provide access to external services. The variables observed by VulnCheck include Langflow’s superuser credentials, OpenAI API keys and AWS access and secret keys. Probing `/root/.cache/langflow/secret_key`\n\n, SSH access and shell history also indicates that attackers are checking whether the host can provide additional paths into the surrounding environment.\n\n## Langflow’s attack surface\n\nLangflow is an open-source, Python-based low-code platform for assembling AI agents, chatbots and retrieval-augmented-generation systems. Its visual editor connects language models, prompts, databases, APIs and other tools, while its source-code access lets developers customize components with Python. User-supplied Python is part of the product’s authoring model, but it must not be treated as trusted code when it reaches a remotely accessible endpoint.\n\nThe project’s [official GitHub repository](https://github.com/langflow-ai/langflow) documents several deployment paths, including a local Python installation, Docker and Langflow Desktop for Windows and macOS. The quickstart runs the service at `http://127.0.0.1:7860`\n\n, while the documented Docker command publishes port `7860`\n\nthrough `docker run -p 7860:7860 langflowai/langflow:latest`\n\n. A deployment bound only to loopback differs from one exposed through a public interface, but the supplied reporting does not establish how many internet-facing Langflow instances are vulnerable.\n\nThe repository also describes built-in API and MCP servers, API and JSON export, multi-agent orchestration, vector-database support and integrations with observability tools including LangSmith and LangFuse. Those capabilities may make more infrastructure and credentials reachable from a compromised workflow host; they do not, by themselves, prove that any specific integration was accessed in this campaign.\n\nThe relevant version history, including earlier Langflow flaws mentioned in the reporting, is:\n\n| Time or release | Security event or status |\n|---|---|\n| January | CVE-2026-0768 disclosed; Langflow 1.4.2 and earlier affected |\n| March | CVE-2026-33017 exploited about a day after disclosure to run Python scripts and harvest `.ENV` and database files |\n| 2026 | CVE-2026-5027 used to write arbitrary files; CVE-2026-55255 used to access other users' workflows and deliver second-stage implants |\n| 2026 | CVE-2026-0770 exploited for root-level command execution and attempted malware and cloud-credential theft |\n| 2026 | CISA warned that CVE-2026-9198 was being exploited after public PoCs appeared |\n| 1.11.6 | Version recommended by Langflow for addressing all known flaws cited in the reporting |\n\nCVE-2026-0768 is part of a series of Langflow vulnerabilities used for code execution, file modification, workflow access, data theft and credential extraction during 2026. The reporting says CVE-2026-33017 was exploited within about a day of disclosure, while the current campaign has no known public PoC.\n\n## What Langflow operators should do\n\nOperators running **1.4.2 or earlier** should upgrade to **Langflow 1.11.6**, the version identified in the reporting as addressing all known flaws in the tool. They should also treat any exposed instance as potentially compromised rather than assuming an upgrade alone invalidates stolen credentials.\n\nThe credentials specifically targeted in the observed requests are `LANGFLOW_SUPERUSER`\n\n, `OPENAI_API*`\n\n, `AWS_ACCESS*`\n\nand `AWS_SECRET*`\n\n. Incident response should include reviewing and rotating Langflow administrator credentials, OpenAI API keys and AWS access credentials if the vulnerable service was reachable by an attacker. The source material does not provide a confirmed compromise count, a list of affected organizations or evidence that every observed request successfully extracted a secret, so those details remain unresolved.\n\nThe GitHub project’s installation guidance requires Python **3.10–3.14** and recommends `uv`\n\nfor local installation. It also supports Docker and a desktop package with bundled dependencies. Those options simplify deployment, but they do not remove the need to control network exposure: the flaw is in an application endpoint, not in a package-installation mechanism.\n\nLangflow combines arbitrary Python customization, external model APIs, cloud credentials and deployable API or MCP interfaces in one service. A remotely reachable validator that executes input without authentication can turn that service into a credential-harvesting foothold before defenders inspect the workflow itself.\n\n## Frequently asked questions\n\n## Which Langflow versions are affected by CVE-2026-0768?+\n\nLangflow versions 1.4.2 and earlier are affected by the unauthenticated remote-code-execution flaw.\n\n## What Langflow version should users install?+\n\nThe reporting recommends upgrading to Langflow 1.11.6, which addresses all known flaws cited in the report.\n\n## Which credentials are attackers targeting?+\n\nObserved requests searched for Langflow administrator credentials, OpenAI API keys, AWS access and secret keys, cached Langflow secrets, SSH access and shell history.\n\n## Is there a public exploit for CVE-2026-0768?+\n\nNo known public proof-of-concept exploit has been reported, although VulnCheck observed active exploitation attempts.\n\n[Sophia Reynolds](/authors/sophia-reynolds/)\n\nSecurity Editor\n\nSophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.", "url": "https://wpnews.pro/news/langflow-flaw-is-now-stealing-openai-and-aws-keys", "canonical_source": "https://forgeeks.net/langflow-cve-2026-0768-exploitation/", "published_at": "2026-09-01 20:05:55+00:00", "updated_at": "2026-09-01 20:23:19.731398+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure"], "entities": ["Langflow", "VulnCheck", "Caitlin Condon", "OpenAI", "AWS"], "alternates": {"html": "https://wpnews.pro/news/langflow-flaw-is-now-stealing-openai-and-aws-keys", "markdown": "https://wpnews.pro/news/langflow-flaw-is-now-stealing-openai-and-aws-keys.md", "text": "https://wpnews.pro/news/langflow-flaw-is-now-stealing-openai-and-aws-keys.txt", "jsonld": "https://wpnews.pro/news/langflow-flaw-is-now-stealing-openai-and-aws-keys.jsonld"}}