Zero-Day Exploit Wave Targets Langflow RCE Flaw to Scrape Cloud and AI API Keys
Threat actors have started actively exploiting a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-0768, within the open-source AI platform Langflow. The flaw carries a CVSS score of 9.8 and resides in the code validator of the framework's custom component editor, affecting all versions up to 1.4.2. Because user-supplied strings sent to the `validate` endpoint are processed without adequate sanitization, the application ultimately passed malicious input to an underlying `exec()` call, allowing arbitrary Python execution as root. Cybersecurity intelligence firm VulnCheck initially captured attacks on its honeypot infrastructure in the United Kingdom, observing attempts surge from 50 over the weekend to roughly 360 hits by Monday. Telemetry indicates that the attack traffic primarily originates from Russian IP space and focuses heavily on early reconnaissance and key exfiltration. Adversaries are actively querying environment variables such as `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*`, and `AWS_SECRET*` to harvest operational secrets. Beyond environment dumps, the incoming exploit payloads inspect the size of `.bash_history`, examine `.ssh` folder configurations, and read the application secret key file located at `/root/.cache/langflow/secret_key`. This incident follows an aggressive series of exploits targeting the platform throughout the year, including CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, and CVE-2026-0770. While the original zero-day was reported via the Zero Day Initiative back in July 2025 and publicly disclosed in January 2026, researchers noted that the problematic `exec()` call was eliminated in version 1.10.1. Security teams running self-hosted Langflow deployments are urged to update instances immediately to release 1.11.6 or later to defend against active exploitation.
Commentary
Langflow instances are the ultimate soft target for credential harvesting: by design, low-code AI pipeline tools are fed privileged OpenAI keys, vector database tokens, and cloud infrastructure credentials so they can orchestrate LLM workflows. Worse, developers often deploy these web UI containers straight into VPCs or local infrastructure with Docker default permissions, meaning the process executes directly as `root`. If an attacker reaches a vulnerable instance, simply grabbing `AWS_SECRET_ACCESS_KEY` and third-party LLM tokens from `/proc/self/environ` provides an instant pivot straight into production compute and customer data lakes. The immediate action is to patch to version 1.11.6, but teams should also ensure that any exposed Langflow service is tucked behind zero-trust network access (ZTNA) or an authenticating reverse proxy rather than sitting directly on the public internet. Additionally, assume any instance vulnerable to CVE-2026-0768 has already leaked its configuration; operators must rotate all downstream AWS secrets, database passwords, and OpenAI API tokens associated with the host.
The Quote to Remember
“Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size”
“The team who analyzed it on our side said it's patched in 1.10.1. The team said the exploit relies on an exec() to execute malicious code, and that exec() was removed in the patch”