Attackers are actively exploiting the Langflow RCE vulnerability tracked as CVE-2026-0768, using it to harvest AWS secrets, OpenAI API keys, and administrative credentials from exposed instances of the open-source AI application framework. The flaw carries a CVSS score of 9.8, according to Qualys ThreatPROTECT, placing it at the top of the critical severity band.
The vulnerability resides in the code validator inside Langflow’s custom component editor. It allows an unauthenticated attacker to execute arbitrary Python code with root privileges by supplying a crafted string to the validate endpoint, no login required, no prior foothold needed.
From honeypot to 360 attacks: how the campaign unfolded
VulnCheck first detected exploitation activity on its UK-based honeypots over the weekend, logging at least 50 attempts, with attack traffic originating primarily from Russia. By the time VulnCheck lead security researcher Caitlin Condon spoke publicly, the count had climbed to 360 observed attacks. Condon described the attacker’s methodology in some detail: ‘Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size.’
In plain terms, whoever is running these attacks is conducting reconnaissance first, then sweeping up every credential or secret they can find in the environment. Cloud keys and AI service tokens are an obvious target: valid AWS credentials or an OpenAI API key can be monetised quickly or used to pivot further.
Condon also noted there are no known public proof-of-concept exploits for CVE-2026-0768, which makes the sustained exploitation activity worth paying attention to. Someone has working code they are not sharing.
According to Indusface, the vulnerability was first reported to the vendor in mid-2025 and disclosed publicly as a zero-day in January 2026. It affects Langflow versions 1.4.2 and earlier.
A platform with a long record of exploitation this year
CVE-2026-0768 is not Langflow’s first rodeo this year, and not by a long way. In March, attackers turned on CVE-2026-33017, a critical code-injection flaw, within roughly a day of its public disclosure, using it to execute Python scripts and collect .ENV and database files. That was followed by exploitation of CVE-2026-5027, which allowed writing arbitrary files to vulnerable servers, and CVE-2026-55255, which let attackers access other users’ AI workflows, steal sensitive data, and deliver second-stage implants.
CVE-2026-0770 was then used to execute commands with root privileges, with attackers attempting to deploy malware and extract cloud credentials, environment variables, and container metadata. Most recently, CISA warned that CVE-2026-9198 was being actively exploited after multiple proof-of-concept exploits became publicly available.
The broader picture is sobering. SecurityWeek reports that VulnCheck has observed more than 15,000 attacks successfully exploiting Langflow instances across three of the known exploited flaws: CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. That is not theoretical exposure, it is confirmed compromise at scale.
As for where the exposure is concentrated geographically, The Hacker News reports that the majority of vulnerable Langflow hosts are located in the US, Germany, Malaysia, Brazil, and India, which gives a sense of where administrators urgently need to act.
What to do if you are running Langflow
Langflow is a Python-based low-code platform that lets users build AI agents, chatbots, and retrieval-augmented generation (RAG) systems by connecting components through a graphical interface. Its flexibility makes it popular; that same flexibility, particularly around code execution, has made it a recurring target.
The fix is straightforward: upgrade to version 1.11.6, the latest release, which addresses all currently known flaws in the platform. Given the pace at which new CVEs have been weaponised this year, often within hours or days of disclosure, leaving any earlier version running in a reachable environment is a risk that is difficult to justify. Administrators should also audit environment variables and rotate any secrets that may have been exposed on affected hosts.
