CyberWorldOpsCyber Security · Threat Intelligence · CVE

About usSeptember 2, 2026

CVE-2026-0768

CRITICAL9.8Published on January 23, 2026

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.

Early warning: exploitation observed

Exploitation observed since Aug 29, 2026
Not yet in the official CISA catalogue
First attack observed 218 days after disclosure
Confirmed by sensors, not only by reports

Source: VulnCheck KEV · Sep 2, 2026 Sep 1, 2026 Aug 30, 2026 Aug 30, 2026 Aug 29, 2026 Aug 29, 2026

CVSS score9.8 / 10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-94

Vendorslangflow

Affected products

Vendors	Prodotto	Versioni
langflow	langflow	1.4.2

Related articles

Langflow sotto attacco: una falla RCE espone chiavi OpenAI, AWS e credenziali root

Vulnerabilities

Langflow Under Attack: RCE Flaw Exposes OpenAI and AWS Keys, Root Credentials

Langflow CVE-2026-0768 RCE flaw exploited to steal AWS and OpenAI keys with root access. See affected versions, fix in 1.11.6 and detection tips.

Sep 1, 20266 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.