Attackers Exploit Critical Langflow Flaw to Harvest Cloud and AI API Keys
Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-0768, in Langflow, an open-source framework for building AI applications. The flaw resides in the code validator of Langflow's custom component editor and affects versions 1.4.2 and earlier, allowing attackers to execute arbitrary Python code with root privileges without any authentication.
Threat intelligence company VulnCheck detects the ongoing campaign on its honeypots in the U.K., which have faced at least 360 exploitation attempts so far, with attack traffic originating primarily from Russia. According to lead security researcher Caitlin Condon, the attacker performs reconnaissance and queries environment variables to steal administrative credentials, Langflow superuser authentication keys, AWS secrets, and OpenAI API keys. The malicious requests also read secret key files, check for SSH access, and inspect bash history.
The vulnerability stems from a lack of proper validation of a user-supplied string before using it to execute Python code on the validate endpoint, according to Trend Micro's Zero Day Initiative. No public proof-of-concept exploits are currently known. This is not the first Langflow flaw exploited this year, as attackers leveraged the critical code-injection bug CVE-2026-33017 within roughly a day of its disclosure in March to execute Python scripts.