Langflow: Critical Langflow flaw exploited to steal OpenAI and AWS keys

Critical Langflow Vulnerability Exploited in Credential-Theft Attacks

Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, an open-source framework for building AI applications. The flaw, rated with a critical severity score, resides in the platform’s custom component editor and allows attackers to execute arbitrary code with root privileges without authentication.

Security firm VulnCheck detected the attacks via honeypots in the U.K., logging 360 exploitation attempts as of today, with the majority of attack traffic originating from Russia. The campaign escalated over the weekend, with at least 50 initial attempts observed. Attackers are targeting environment variables, including Langflow superuser credentials, AWS secrets, and OpenAI API keys, by querying files like /root/.cache/langflow/secret_key and checking .ssh access and .bash_history.

The vulnerability stems from improper validation of user-supplied input in the validate endpoint’s code parameter, enabling arbitrary Python code execution. While no public proof-of-concept (PoC) exploit is known, the flaw affects Langflow versions 1.4.2 and earlier, disclosed in January 2026.

This is not the first time Langflow has been targeted. Earlier this year, attackers exploited:

• CVE-2026-33017 (March) – A code-injection flaw used to harvest .ENV files and database contents within a day of disclosure.
• CVE-2026-5027 – Arbitrary file writes to vulnerable servers.
• CVE-2026-55255 – Unauthorized access to AI workflows, data theft, and second-stage malware deployment.
• CVE-2026-0770 – Root-level command execution for credential extraction and malware deployment.
• CVE-2026-9198 – Recently flagged by CISA after multiple PoC exploits surfaced.

Langflow users are advised to upgrade to version 1.11.6, which patches all known vulnerabilities in the platform. The framework, widely used for AI workflows, chatbots, and RAG systems, remains a high-value target due to its integration with sensitive credentials and cloud services.

Source: https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/

Langflow TPRM report: https://www.rankiteo.com/company/langflow

"id": "lan1788294296",
"linkid": "langflow",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Technology/AI',
                        'location': 'Global',
                        'name': 'Langflow',
                        'type': 'Open-source AI framework'}],
 'attack_vector': 'Improper validation of user-supplied input in the '
                  '`validate` endpoint’s `code` parameter',
 'customer_advisories': 'Langflow users advised to upgrade to version 1.11.6 '
                        'immediately.',
 'data_breach': {'data_exfiltration': 'Yes',
                 'file_types_exposed': ['.ENV', '.ssh', '.bash_history'],
                 'personally_identifiable_information': 'Yes (credentials, API '
                                                        'keys)',
                 'sensitivity_of_data': 'High (superuser credentials, AWS '
                                        'secrets, OpenAI API keys)',
                 'type_of_data_compromised': ['Credentials',
                                              'Environment variables',
                                              'Database contents',
                                              'SSH access',
                                              'Bash history']},
 'date_detected': '2026-01-01',
 'date_publicly_disclosed': '2026-01-01',
 'description': 'Threat actors are actively exploiting CVE-2026-0768, a '
                'critical unauthenticated remote code execution (RCE) '
                'vulnerability in Langflow, an open-source framework for '
                'building AI applications. The flaw allows attackers to '
                'execute arbitrary code with root privileges without '
                'authentication, targeting environment variables including '
                'Langflow superuser credentials, AWS secrets, and OpenAI API '
                'keys.',
 'impact': {'data_compromised': 'Environment variables (Langflow superuser '
                                'credentials, AWS secrets, OpenAI API keys), '
                                '.ssh access, .bash_history, database contents',
            'identity_theft_risk': 'High (PII and credentials exposed)',
            'operational_impact': 'Arbitrary code execution with root '
                                  'privileges, potential malware deployment',
            'systems_affected': 'Langflow versions 1.4.2 and earlier'},
 'initial_access_broker': {'entry_point': 'CVE-2026-0768 (RCE vulnerability)',
                           'high_value_targets': 'Environment variables, AWS '
                                                 'secrets, OpenAI API keys'},
 'investigation_status': 'Ongoing',
 'motivation': 'Credential theft, data exfiltration, malware deployment',
 'post_incident_analysis': {'corrective_actions': 'Patch management, input '
                                                  'validation improvements',
                            'root_causes': 'Improper validation of '
                                           'user-supplied input in the '
                                           '`validate` endpoint’s `code` '
                                           'parameter'},
 'recommendations': 'Upgrade to Langflow version 1.11.6 to patch all known '
                    'vulnerabilities. Monitor for unauthorized access to '
                    'environment variables and sensitive files.',
 'references': [{'source': 'VulnCheck'}, {'source': 'CISA'}],
 'response': {'containment_measures': 'Upgrade to Langflow version 1.11.6',
              'remediation_measures': 'Patching known vulnerabilities in '
                                      'Langflow',
              'third_party_assistance': 'VulnCheck (security firm)'},
 'threat_actor': 'Unknown (Majority of attack traffic originating from Russia)',
 'title': 'Critical Langflow Vulnerability Exploited in Credential-Theft '
          'Attacks',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2026-0768'}