Attackers are exploiting an undocumented remote code execution vulnerability in the open-source Langflow framework for building artificial intelligence applications, with the aim of stealing credentials, tokens, and access keys, including OpenAI and AWS keys. The vulnerability is tracked as CVE-2026-0768 and has a critical severity rating. It resides in the code validation tool within the custom components editor.
Threat intelligence company VulnCheck observed the activity through its honeypots in the United Kingdom, where it recorded at least 50 exploitation attempts over the weekend. Caitlin Condon, the company’s senior security researcher, said the activity later escalated, with the total number of observed attacks rising to 360 attempts, while the attack traffic originated primarily from Russia.
How is the vulnerability exploited?
The issue allows an attacker to execute arbitrary code without authentication and with root privileges. The flaw is related to how the code parameter sent to the validate endpoint is processed; the user-provided text is not properly validated before being used to execute Python code.
According to Condon, attackers begin with reconnaissance and then query environment variables to search for Langflow administrative credentials or superuser authentication keys, along with AWS secrets and OpenAI API keys. The observed requests included variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, in addition to the /root/.cache/langflow/secret_key file, checks for SSH accessibility, and the size of the .bash_history file.
Why does this matter?
The impact of a compromise is not limited to the Langflow server itself. The platform, which is built on Python and operates using a low-code approach, is used to create applications, agents, chats, and retrieval-augmented generation systems by connecting language models, databases, APIs, and other components. Therefore, access to environment variables or secret files could turn the server into a launch point for accessing connected artificial intelligence or cloud services.
The available facts indicate that the issue is part of a broader pattern, as other vulnerabilities in Langflow were exploited earlier in the same year. CVE-2026-33017 was exploited about one day after its disclosure to execute Python scripts and steal ENV files and databases, while CVE-2026-5027 was used to write arbitrary files, and CVE-2026-55255 was exploited to access other users’ workflows, steal sensitive data, and deliver subsequent malware. CVE-2026-0770 also saw attempts to execute commands with root privileges and extract cloud credentials and container data, while CISA later warned of exploitation of CVE-2026-9198 after multiple proof-of-concept examples were published.
What should users do?
The source recommends that Langflow users upgrade to version 1.11.6, which addresses all the known flaws mentioned in the article. According to Condon, there were no known public exploit examples for CVE-2026-0768 at the time the report was prepared, but the observation of active exploitation means that the absence of a published exploit does not eliminate the need to treat affected systems as vulnerable.
Editorial reading from certi.news: The practical risk here results from the combination of three factors clearly identified in the source: unauthenticated code execution, root privileges, and operational secrets present in the targeted environment. The source does not establish whether the observed attacks resulted in confirmed compromises of specific production environments, so this point still requires independent verification. Operators should also review logs and exposed secrets when dealing with affected versions.