Threat
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Publication date not yet evaluated · Added · 3 reports thehackernews.com
Page published · Page updated
Coverage timeline
Why it matters
Langflow is a widely used low-code platform for building AI agents, chatbots, and RAG systems, so an actively exploited RCE that steals OpenAI and AWS keys directly compromises organizations' AI infrastructure and cloud accounts.
Threat actors are actively exploiting CVE-2026-0768, an unauthenticated remote code execution flaw in Langflow's custom component code validator, to run arbitrary Python as root and harvest credentials from AI application servers. VulnCheck honeypots observed hundreds of attempts (rising from 50 to 360) querying environment variables like LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, and reading /root/.cache/langflow/secret_key, with traffic primarily from Russia.
Summary
VulnCheck reports active in-the-wild exploitation of CVE-2026-0768, a critical unauthenticated remote code execution flaw in the code validator of Langflow's custom component editor that allows arbitrary Python code execution with root privileges. The vulnerability, disclosed in January and affecting Langflow 1.4.2 and earlier, is being abused to steal credentials, tokens, and keys.[0][5]
VulnCheck honeypots in the U.K. observed at least 50 exploitation attempts over the weekend, rising to 360 by the day of reporting, with traffic originating primarily from Russia. Attackers conduct reconnaissance and query environment variables and secret files to harvest Langflow superuser credentials, AWS secrets, and OpenAI API keys. No named threat actor is attributed and no public proof-of-concept exploit is known.[0]
The activity reflects sustained threat-actor interest in AI development platforms as high-value targets, following a string of Langflow vulnerabilities exploited through 2026 (CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, CVE-2026-0770, and CVE-2026-9198). Users are urged to upgrade to Langflow 1.11.6, which addresses all known flaws.[0]
Attack chain
- Exploitation for RCE: Attackers exploit CVE-2026-0768 by supplying a crafted code parameter to Langflow's validate endpoint, which lacks proper validation of the user-supplied string before executing it as Python code, achieving unauthenticated arbitrary code execution with root privileges.[0][5]
- Reconnaissance and credential harvesting: Attacker requests query environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size to harvest administrative credentials, AWS secrets, and OpenAI API keys.[0]
Disclosure timeline
| Date | Event |
|---|---|
| January 2026 | CVE-2026-0768 disclosed, affecting Langflow versions 1.4.2 and earlier.[0] |
| March 2026 | Attackers exploited the critical Langflow code-injection flaw CVE-2026-33017 within about a day of its disclosure to execute Python scripts and harvest .ENV and database files.[0] |
| Weekend before September 1, 2026 | VulnCheck honeypots in the U.K. were targeted in at least 50 exploitation attempts against CVE-2026-0768.[0] |
| September 1, 2026 | Article published reporting that observed attacks against CVE-2026-0768 had risen to 360.[0] |
How it works
CVE-2026-0768 exists within the handling of the code parameter provided to Langflow's validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code, enabling unauthenticated arbitrary code execution in the context of the root user.[0][5]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Langflow | Versions 1.4.2 and earlier are affected by CVE-2026-0768; additional flaws exploited in 2026 include CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, CVE-2026-0770, and CVE-2026-9198. | Fixed in Langflow 1.11.6, which addresses all known flaws.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | /root/.cache/langflow/secret_key | Attacker requests read this Langflow secret file during credential-harvesting activity.[0] |
| cve | CVE-2026-0768 | Critical Langflow input-validation flaw in the validate endpoint actively exploited for root-level unauthenticated Python code execution.[0][5] |
Key takeaways
- AI development platforms like Langflow are repeatedly targeted because they provide access to sensitive cloud credentials, API keys, and connected systems.[0]
- CVE-2026-0768 is being actively exploited even though no public proof-of-concept exploit is known, underscoring the need to prioritize patching to Langflow 1.11.6.[0]
Defensive actions
- Upgrade Langflow to version 1.11.6.: Version 1.11.6 addresses CVE-2026-0768 and all other known Langflow flaws being exploited in the wild.[0]
- Rotate Langflow superuser credentials, AWS secrets, and OpenAI API keys exposed to vulnerable instances.: Attackers query environment variables and read secret files to harvest these credentials for follow-on abuse.[0]
- Hunt for requests to the validate endpoint, reads of /root/.cache/langflow/secret_key, and probing of environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*.: These are the observed reconnaissance and credential-harvesting behaviors of the CVE-2026-0768 exploitation activity.[0]