Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, identified as CVE-2026-0768, in Langflow, an open-source framework for building AI applications. The attacks aim to steal credentials, tokens, and various API keys.
The vulnerability, which carries a critical severity rating, resides in the code validator component of Langflow's custom component editor. It allows for the execution of arbitrary code without authentication and with root privileges. The flaw stems from insufficient validation of user-supplied strings before they are used to execute Python code.
Threat intelligence firm VulnCheck first detected exploitation attempts on its honeypots in the U.K. on September 1, 2026. Initially, approximately 50 attacks were observed over a weekend, with traffic predominantly originating from Russia. This activity quickly intensified, with the total number of observed attacks escalating to 360 shortly thereafter.
During these attacks, threat actors conduct reconnaissance by querying environment variables to harvest sensitive information. Specifically, they are attempting to retrieve Langflow administrative credentials or superuser authentication keys, AWS secrets (including access and secret keys), and OpenAI API keys. Attackers are also observed attempting to read the `/root/.cache/langflow/secret_key` file and checking for `.ssh` access and `.bash_history` size.
CVE-2026-0768 was publicly disclosed in January and affects Langflow versions 1.4.2 and earlier. There are currently no known public proof-of-concept exploits available for this specific vulnerability.
This is not the first time Langflow has been targeted by exploits this year. In March, attackers quickly leveraged CVE-2026-33017, a critical code-injection flaw, within a day of its disclosure to execute Python scripts and extract `.ENV` and database files. Subsequent attacks exploited CVE-2026-5027 to write arbitrary files to vulnerable servers and CVE-2026-55255 to access other users' AI workflows, steal sensitive data, and deliver secondary implants. Additionally, CVE-2026-0770 was exploited to execute commands with root privileges, with attempts to deploy malware and extract cloud credentials, environment variables, and container metadata. More recently, the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning regarding the active exploitation of CVE-2026-9198, following the public availability of multiple proof-of-concept exploits.
Langflow is a Python-based low-code platform designed for creating AI applications, agents, chatbots, and retrieval-augmented generation (RAG) systems. It enables users to build workflows through a graphical interface by connecting various components for language models, prompts, databases, and APIs.
Users of Langflow are strongly advised to upgrade to the latest available version, 1.11.6, which includes patches for all known vulnerabilities affecting the platform.
