Attackers Exploit Critical Langflow Flaw to Harvest Cloud Credentials

Attackers are actively targeting Langflow, the open-source low-code platform developers use to wire together AI agents, RAG pipelines, and chatbot workflows. The vulnerability at the center of it, CVE-2026-0768, is about as bad as these things get on paper, and the real-world exploitation data is now catching up to the score.

The flaw sits in a specific corner of the product: the code validator inside Langflow's custom component editor. According to analysis by SecurityWeek citing VulnCheck research, the validate endpoint accepts a user-supplied string and passes it to Python's execution layer without sanitization. That means an unauthenticated request to a public-facing Langflow instance can run arbitrary Python as root. No login required. The CVE carries a CVSS score of 9.8.

VulnCheck VP of security research Caitlin Condon flagged the first live exploitation on its honeypot systems over the weekend, reporting 50-plus hits within hours of the initial observation. As reported by BleepingComputer, that number climbed to 360 recorded attacks within days, with traffic originating primarily from Russia and initially hitting canary systems in the United Kingdom.

What the attackers are actually after isn't the server itself. According to BleepingComputer's account of VulnCheck's findings, the campaign queries environment variables and files to harvest Langflow superuser credentials, AWS secrets, and OpenAI API keys. That's the real exposure: Langflow typically sits at the junction of language models, external APIs, databases, and cloud storage, so a compromised instance hands the attacker a pre-authenticated connection to a wide range of downstream systems.

Dark Reading noted that one observed campaign, which used Python scripts with Chinese-language comments, appeared to be hunting for Langflow instances that had already been backdoored, then layering in additional persistence on top. That's a meaningful detail: it suggests at least some of these machines were compromised before CVE-2026-0768 was even armed.

The timeline here deserves scrutiny. CVE-2026-0768 was reported to Trend Micro's Zero Day Initiative in July 2025 and publicly disclosed as a zero-day in January 2026, according to SecurityWeek. The affected versions, everything up to and including Langflow 1.4.2, have been known quantities for months. Yet exploitation is only now spiking at scale.

That gap isn't unusual, but it's worth flagging for teams running Langflow in any internet-accessible configuration. Proof-of-concept code doesn't appear to be public, which means attackers worked out the exploit independently, or the bar to figure it out from the advisory was simply low enough not to need one.

The broader pattern VulnCheck is documenting around Langflow is worth attention in its own right. As the firm noted in findings covered by The Hacker News, before 2026, only a single Langflow vulnerability had been observed exploited in the wild. This year, that number has grown to 12, with more than 15,000 successful exploitation attempts logged across three earlier CVEs alone. Langflow is now, functionally, a recurring target class, not an isolated incident.

IBM acquired Langflow in 2025 through its purchase of DataStax. The fix is to patch past 1.4.2, and any instance exposed to the internet without authentication controls should be treated as potentially compromised regardless of whether an alert has fired.

Sources cited:
- BleepingComputer (https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/)
- SecurityWeek (https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/)
- Dark Reading (https://www.darkreading.com/vulnerabilities-threats/critical-langflow-flaw-exploited-attacks-rise)
- The Hacker News (https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html)