Topic

#AI Security

2 articles

critical3 sourcesCVE-2025-3248 CVE-2026-0768 +6

Zero-Day Exploit Wave Targets Langflow RCE Flaw to Scrape Cloud and AI API Keys

Threat actors have started actively exploiting a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-0768, within the open-source AI platform Langflow. The flaw carries a CVSS score of 9.8 and resides in the code validator of the framework's custom component editor, affecting all versions up to 1.4.2. Because user-supplied strings sent to the `validate` endpoint are processed without adequate sanitization, the application ultimately passed malicious input to an underlying `exec()` call, allowing arbitrary Python execution as root. Cybersecurity intelligence firm VulnCheck initially captured attacks on its honeypot infrastructure in the United Kingdom, observing attempts surge from 50 over the weekend to roughly 360 hits by Monday. Telemetry indicates that the attack traffic primarily originates from Russian IP space and focuses heavily on early reconnaissance and key exfiltration. Adversaries are actively querying environment variables such as `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*`, and `AWS_SECRET*` to harvest operational secrets. Beyond environment dumps, the incoming exploit payloads inspect the size of `.bash_history`, examine `.ssh` folder configurations, and read the application secret key file located at `/root/.cache/langflow/secret_key`. This incident follows an aggressive series of exploits targeting the platform throughout the year, including CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, and CVE-2026-0770. While the original zero-day was reported via the Zero Day Initiative back in July 2025 and publicly disclosed in January 2026, researchers noted that the problematic `exec()` call was eliminated in version 1.10.1. Security teams running self-hosted Langflow deployments are urged to update instances immediately to release 1.11.6 or later to defend against active exploitation.

high1 source

Indirect Prompt Injection and Python Module Hijacking Bypass Claude Code Auto Mode

Security researcher Johann Rehberger has demonstrated a technique to bypass security checks in Anthropic's Claude Code coding assistant when running with Auto Mode enabled. Auto Mode operates as a convenience setting designed to execute low-risk local actions without prompting the user for manual confirmation each time. To test the boundary, the researcher created a website mimicking an archive of notebook records and asked Claude Code to generate a summary. During processing, Claude downloaded a zip archive containing encoded data and an included decoder binary. While Claude initially refused to run the bundled decoder, it opted to write and execute a custom Python script to decode the records autonomously. The researcher exploited standard Python module resolution order by placing a malicious file named `struct.py` alongside the target data in the downloads folder. Because Claude executed its custom script directly inside the downloads directory, Python prioritized and imported the rogue `struct.py` over the standard library module. The payload silently maintained execution flow, allowing Claude's generated script to finish without raising alarms, while the malicious code performed unauthorized background actions. In advanced variations, the hijacked process was able to spawn an entirely separate, nested Claude Code agent with independent tool execution privileges. The exploit bypassed automated checks in an estimated 60% to 80% of test iterations, depending on the working directory chosen by the model and environmental factors. Curiously, in instances where Claude detected anomalous behavior post-execution and attempted to kill the rogue process, Auto Mode occasionally blocked the remediation command itself. Anthropic reportedly marked the vulnerability report as informative, stating that Auto Mode is an assistive classifier rather than an ironclad security perimeter.

← all articles