By Attackers are actively exploiting a critical flaw in Langflow and they are not after your database — they want your OpenAI bill. CVE-2026-0768, a CVSS 9.8 unauthenticated remote code execution vulnerability, is being used right now to harvest API keys, cloud credentials, and AI provider tokens from internet-exposed Langflow instances. If your deployment is reachable from the public internet, treat it as compromised until proven otherwise.
What CVE-2026-0768 Actually Does
The vulnerability lives in Langflow’s custom component editor — specifically the /api/v1/validate/code endpoint. This endpoint lets developers test Python snippets before adding them to a flow. The problem: Langflow passes user-supplied input directly to Python’s exec() with no sanitization and no authentication check. Anyone on the internet can hit that endpoint with a crafted POST request and execute arbitrary code as root.
This is not a novel pattern. CVE-2025-3248, disclosed in April 2025, was a different RCE in the same validate endpoint — fixed in Langflow 1.3.0, apparently not far enough. CVE-2026-0768 is a subsequent injection in the same functional area, affecting all versions up to 1.4.2. JFrog Security Research found that “patched” Langflow versions for related CVEs remained exploitable after fixes shipped. There is a pattern worth taking seriously.
What Attackers Are Taking
The exploitation chain is methodical. After gaining root code execution, attackers query environment variables: OPENAI_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, Anthropic tokens, GCP credentials, and database connection strings. They also read /root/.cache/langflow/secret_key and check .bash_history for lateral movement.
This is a cost-shifting attack. Stolen API keys mean the attacker runs LLM workloads on your bill. VulnCheck confirmed 50+ Canary detections, with 360 total attacks observed by September 2. Exploitation escalated from isolated probing in late August to continuous, multi-source scanning — a shift that typically signals the vulnerability has been shared widely across threat actor communities.
How Many Instances Are Exposed
Censys tracks roughly 7,000 internet-facing Langflow deployments; some researchers put the figure at 74,000. Many run with LANGFLOW_AUTO_LOGIN=true — the default — meaning there is no login page at all. Developers routinely spin up Langflow for internal tooling and never restrict network access. The attack surface is not a niche edge case.
The Broader Problem With AI Dev Frameworks
This is Langflow’s 12th exploited CVE in 2026. That number is not a coincidence — it reflects a structural problem. AI developer frameworks are built for productivity, not hardening. They store API keys in environment variables because that is the recommended LLM integration pattern. When those tools get deployed internet-facing without a firewall, attackers have a reliable, high-value target: one exploit hands them every AI credential the application uses.
CISA’s September 2026 KEV batch underscores this shift. For the first time, AI and ML components — LiteLLM, Starlette, JFrog Artifactory — constitute nearly half of new federal patch mandates. Langflow is not alone. Ollama, Gradio, and Open WebUI have all had similar issues this year.
What to Do Right Now
There is no confirmed patched version for CVE-2026-0768 as of September 9, 2026. The vendor advisory with a fixed release has not been published. Mitigation is the only reliable option.
- Remove internet access. Put Langflow behind a VPN or restrict it to your internal network. If the endpoint is unreachable, the exploit is not viable. This is the single most effective control.
- Disable auto-login. Set
LANGFLOW_AUTO_LOGIN=false. This forces authentication at the Langflow layer and raises the bar, though it does not fix the underlying flaw. - Rotate all credentials. Assume any API keys, AWS secrets, Anthropic tokens, and database strings stored in your Langflow environment have been read. Rotate immediately, regardless of whether you see suspicious activity — attackers in this campaign are operating quietly by design.
Monitor the official Langflow security advisories for a patched release. When it ships, verify the changelog explicitly confirms CVE-2026-0768 is addressed — given the history here, version number alone is not enough. Read the notes.
Sources: BleepingComputer, Forkast News, Dark Reading, The Hacker News.
