Langflow’s 12th Exploited CVE Confirms AI Frameworks Are Now Credential Harvesting Infrastructure

Attackers are exploiting CVE-2026-0768, a critical CVSS 9.8 vulnerability in Langflow's validate endpoint, to harvest credentials from AI infrastructure, with over 15,000 successful exploitation attempts recorded across 12 CVEs in 2026. The campaign, confirmed by VulnCheck on September 1, 2026, targets environment variables and sensitive files to steal OpenAI and Anthropic API keys, cloud credentials, and database strings, turning AI frameworks into primary credential harvesting infrastructure.

The Shift to AI Infrastructure as a Primary Credential Vector Attackers are systematically targeting Langflow, the popular open-source low-code platform for LLM applications, to harvest credentials. This shift from theoretical research to automated exploitation demonstrates that AI infrastructure is now a primary target for those seeking to bypass traditional perimeter defenses. The emergence of CVE-2026-0768, a critical CVSS 9.8 vulnerability, underscores this shift. Published as a 0-day advisory https://www.zerodayinitiative.com/advisories/ZDI-26-034/ by ZDI on January 9, 2026, the flaw resides in the validate endpoint of Langflow’s custom component editor. By passing a user-supplied code parameter to Python’s exec function without sanitization, the vulnerability allows for unauthenticated remote code execution. This exposure is significantly compounded by Langflow’s default auto-login feature, which frequently leaves these instances accessible to the public internet without any authentication requirement. While the technical nature of the flaw is a classic CWE-94 code injection, the operational reality of its exploitation is far more sophisticated. As of September 1, 2026, VulnCheck confirms https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/ active exploitation of this vulnerability. The observed attacker behavior is not focused on destructive actions like ransomware or wipers. Instead, it is characterized by quiet, persistent credential extraction. Attackers are systematically querying environment variables and targeting sensitive files, including /root/.cache/langflow/secret key, to gain deeper access to the underlying infrastructure. This is not an isolated incident. The threat landscape for Langflow has accelerated dramatically throughout 2026. Before this year, there was only one known Langflow vulnerability exploited in the wild. Since then, researchers have identified 11 additional vulnerabilities targeted by attackers. This surge in interest has resulted in over 15,000 successful exploitation attempts https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/ across a cluster of adjacent CVEs, including CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. Attackers are treating these AI frameworks as high-value repositories for embedded credentials. The Mechanics of Automated Harvesting The transition from research to mass exploitation is best illustrated by the campaign observed starting June 25, 2026. This chain involved CVE-2026-33017, an unauthenticated RCE, paired with CVE-2026-55255, an IDOR vulnerability. This specific chain targeted approximately 7,000 servers, with a clear objective: the theft of OpenAI and Anthropic API keys, cloud provider credentials for AWS, GCP, and Azure, and database connection strings. By compromising the AI orchestration layer, attackers gain immediate access to the very tokens that power an organization’s LLM integrations, effectively turning the AI infrastructure into a self-service portal for sensitive data. Indicators of compromise, such as unexpected NATS worker processes, mass reads of .env and .db files, and outbound connections to 45.207.216.55:8084, suggest a highly automated approach to reconnaissance and exfiltration. The GHSA-x5pr-rvjj-j6qm https://github.com/advisories/GHSA-x5pr-rvjj-j6qm entry further highlights the systemic nature of these risks within the ecosystem. For CISOs and security architects, the implication is that the AI stack can no longer be treated as a sandbox environment. It is a critical component of the enterprise attack surface that requires the same level of rigor as core production databases. Securing the AI Orchestration Layer Mitigating these risks requires moving beyond standard patching cycles, especially when zero-day windows remain open for extended periods. Organizations must immediately restrict network access to Langflow instances and ensure that LANGFLOW AUTO LOGIN is set to false. Furthermore, enforcing authentication at the network edge and transitioning to brokered, short-lived credentials via tools like Vault or KMS is essential to prevent the catastrophic impact of a single RCE. Embedding static API keys directly into flows is a practice that must be retired. Given the scale of active exploitation, any organization currently running Langflow should assume that existing credentials — including AI provider tokens and database strings — have been compromised and initiate a full rotation of all configured secrets.