"Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size," Caitlin Condon explained.
CVE-2026-0768: unauthenticated remote code execution in Langflow
Security researchers report active exploitation of CVE-2026-0768, a critical, unauthenticated remote code execution vulnerability in Langflow’s custom component editor. The flaw affects Langflow versions 1.4.2 and earlier and allows arbitrary Python code to be executed with root privileges. The vulnerability stems from improper validation of a user-supplied string passed as the code parameter to the validate endpoint.
Observed attacker behavior and harvested data
VulnCheck detected systematic attempts to harvest credentials, tokens, and keys from compromised Langflow instances. The activity includes reconnaissance queries of environment variables and filesystem locations to extract administrative and cloud credentials. That behavior, as reported by VulnCheck lead security researcher Caitlin Condon, specifically targets variables and files including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*, and /root/.cache/langflow/secret_key, and probes .ssh access and .bash_history size.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadScale, origin and proof-of-concept status
VulnCheck’s honeypots in the U.K. recorded at least 50 exploitation attempts over a single weekend, with attack traffic originating primarily from Russia. Condon later reported that the activity intensified and the total observed attacks rose to 360 as of today. According to the reporting, there are no known public proof-of-concept (PoC) exploits for CVE-2026-0768.
Context: a string of fast-following Langflow exploits in 2026
This is not an isolated incident for Langflow in 2026. In March, attackers used CVE-2026-33017 — a critical code-injection vulnerability — within about a day of its disclosure to execute Python scripts and harvest .ENV and database files. That episode was followed by exploitation of CVE-2026-5027 to write arbitrary files and CVE-2026-55255 to access other users’ AI workflows, steal sensitive data, and deliver second-stage implants. Attackers also exploited CVE-2026-0770 to execute commands with root privileges and attempted to deploy malware and extract cloud credentials, environment variables, and container metadata. More recently, CISA warned that CVE-2026-9198 was being exploited after multiple proof-of-concept exploits became publicly available.
What this means for technologists and security teams, Langflow users and affected enterprises, and adversaries
- Technologists and security teams: Expect credential theft after initial access — the reporting cautions that "overall prevention scores can hide what happens after initial access," and notes that once attackers use valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, underscoring how post-compromise activity can defeat perimeter controls.
- Langflow users and affected enterprises/procurement leaders: Langflow users are advised to upgrade to version 1.11.6, which the reporting says addresses all known flaws in the tool. Enterprises that run Langflow in production should check for exposure of the validate endpoint, review environment variables and secret storage, and rotate any potentially affected keys or tokens referenced in the observed queries (for example, OPENAI_API* and AWS_* variables).
- Adversaries and threat actors: The pattern of rapid exploitation following disclosure — including multiple distinct CVEs this year used for credential harvesting and code execution — demonstrates a clear operational preference for targeting AI development platforms. Observed traffic in this campaign came primarily from Russia, according to VulnCheck’s honeypot telemetry.
Technical defenders and Langflow operators face a narrow, concrete set of actions: apply the update to 1.11.6, audit and rotate exposed secrets, and monitor for the specific indicators described by VulnCheck (environment-variable queries, reads of /root/.cache/langflow/secret_key, and probes of .ssh and .bash_history). The incident also illustrates a recurring pattern in which initial compromise leads quickly to credential theft — a phase change that conventional prevention scores can obscure.
Read the original report: https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/
