Threat actors are exploiting an unauthenticated remote code execution vulnerability in Langflow. The flaw is tracked as CVE-2026-0768. Langflow is an open-source framework for building artificial intelligence applications. The vulnerability is being used to steal credentials, tokens, and keys.
The security issue received a critical severity rating. It resides in the code validator of Langflow's custom component editor.
Threat intelligence company VulnCheck detected the activity on its honeypots in the United Kingdom. The honeypots were targeted in at least 50 exploitation attempts over the weekend. Attack traffic originated primarily from Russia.
VulnCheck lead security researcher Caitlin Condon said that the activity intensified. The total number of observed attacks increased to 360.
According to Condon, the attacker conducts reconnaissance. The attacker queries environment variables to harvest administrative credentials or superuser authentication keys for Langflow instances, AWS secrets, and OpenAI API keys.
Condon explained that attacker requests are querying environment variables including LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, and AWS_SECRET. Requests are also reading /root/.cache/langflow/secret_key, checking SSH access, and checking bash history size.
Langflow is an open-source, Python-based low-code platform. It is used for building artificial intelligence applications, agents, chatbots, and retrieval-augmented generation systems.
The platform lets users create workflows in a graphical interface. Users connect components for language models, prompts, databases, APIs, and other tools.
The CVE-2026-0768 vulnerability was disclosed in January. It affects Langflow versions 1.4.2 and earlier. It allows executing arbitrary code without authentication with root privileges.
The vulnerability's description notes that the specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. Trend Micro's Zero Day Initiative also notes this cause.
Condon says that there are no known public proof-of-concept exploits. CVE-2026-0768 is not the first Langflow vulnerability exploited this year.
Langflow users are recommended to upgrade to the latest available version, 1.11.6. This version addresses all known flaws in the tool.
