What Happened
Threat actors are actively exploiting a critical, unauthenticated remote code execution vulnerability in Langflow, the open-source platform for visually building AI agent workflows, to harvest cloud and AI-provider credentials from exposed servers. The flaw, tracked as CVE-2026-0768 (CVSS 9.8), was disclosed in January and affects Langflow versions 1.4.2 and earlier.
The bug lives in Langflow's custom component editor: a user-supplied string reaches Python's code-execution path without proper validation, letting an unauthenticated attacker run arbitrary code as root on the server.
Attackers Are Hunting for Credentials, Not Deploying Ransomware
Threat intelligence firm VulnCheck detected the activity on its honeypots in the United Kingdom, logging at least 50 exploitation attempts over a single weekend, with traffic concentrated from Russia. By the time VulnCheck published its findings, the observed attack volume had climbed to 360 attempts.
Rather than dropping ransomware or destructive payloads, the malicious requests are focused and targeted, querying for:
- Environment variables including
LANGFLOW_SUPERUSER,OPENAI_API*,AWS_ACCESS*, andAWS_SECRET* - The contents of
/root/.cache/langflow/secret_key .sshaccess and.bash_historysize, likely to gauge further lateral-movement potential
VulnCheck lead security researcher Caitlin Condon noted the activity reflects reconnaissance and credential harvesting rather than immediate destructive intent — attackers appear to be building an inventory of valuable access before deciding how to monetize it. Notably, there is no known public proof-of-concept for CVE-2026-0768, meaning the attackers exploiting it are working from non-public knowledge of the flaw.
Part of a Wider AI-Tooling Exploitation Wave
The Langflow campaign is running alongside exploitation of CVE-2026-66066 ("KindaRails2Shell", CVSS 9.5), a Ruby on Rails vulnerability that abuses a discrepancy between Active Storage and libvips to read arbitrary files and leak secrets such as secret_key_base, database passwords, and cloud storage credentials via a crafted image upload.
Langflow specifically has become an increasingly popular target in 2026. VulnCheck notes that prior to this year, only a single exploited Langflow vulnerability had been observed in the wild — but 11 new vulnerabilities are now being actively targeted, with more than 15,000 successful exploitation attempts recorded against flaws including CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. As many as 12 distinct Langflow vulnerabilities have been exploited since 2025.
A structural factor compounds the risk: Langflow is designed to be publicly accessible by default, meaning many production deployments are internet-facing without administrators necessarily realizing the exposure.
Recommendations
- Identify all internet-exposed Langflow instances immediately — exposure is common given the platform's default configuration.
- Upgrade to Langflow 1.11.6, which addresses CVE-2026-0768 alongside several other recently disclosed and exploited flaws.
- Rotate any OpenAI and AWS credentials that were accessible to a vulnerable Langflow instance, treating exposure as compromise until proven otherwise.
- Review environment variables and local secret files — including
/root/.cache/langflow/secret_key— for signs of unauthorized access. - Restrict network access to Langflow management interfaces to trusted networks rather than relying on default deployment settings.
Why This Matters
Langflow sits at the center of a growing wave of AI-agent-building platforms being rushed into production without the network-exposure discipline applied to traditional infrastructure. A pre-auth RCE that hands attackers root access — combined with a platform that's internet-facing by default — is a near-ideal setup for silent, large-scale credential harvesting. Because the current campaign is reconnaissance-focused rather than destructive, many affected organizations may not realize their OpenAI and AWS keys have already been read until those credentials show up being abused elsewhere.