Langflow Under Attack: RCE Flaw Exposes OpenAI and AWS Keys, Root Credentials

Malicious actors are exploiting CVE-2026-0768, a critical Langflow vulnerability that allows unauthenticated remote Python code execution. Attacks primarily target secrets stored in the environment, including OpenAI API keys, AWS credentials, administrative tokens, and other data that can be used to expand the compromise.

The activity was reported on September 1, 2026. VulnCheck detected it through honeypots in the United Kingdom, initially recording at least 50 attempts over an unspecified weekend. Researcher Caitlin Condon later reported a total of 360 observed attacks.

Langflow’s Validator Executes Attacker-Controlled Code

Langflow is an open-source Python framework for building AI applications through a low-code interface. It allows users to connect language models, prompts, databases, APIs, and other tools to create agents, chatbots, and RAG systems.

The vulnerability affects the custom component editor, specifically the endpoint used to validate code. The user-controlled code parameter is not properly verified before being passed to the Python execution process.

An attacker can therefore send a specially crafted request to the validate endpoint and execute arbitrary instructions. No credentials or user interaction are required.

The code also runs in the context of the root user. This turns the flaw from a simple application-level vulnerability into a potential full compromise of the host or container running Langflow.

CVE-2026-0768 is classified as CWE-94, which covers improper code generation and the resulting code injection. Its Zero Day Initiative identifier is ZDI-CAN-27322, with advisory ZDI-26-034.

The vector assigned by the Zero Day Initiative CNA is:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The associated score is 9.8 out of 10. NVD, however, has not yet published its own numerical assessment; its record currently lists the NVD base score as N/A.

Affected Versions and Upgrade to 1.11.6

The scope of affected versions is not described consistently across sources. NVD lists Langflow 1.4.2 in its table, while other reports also include versions earlier than 1.4.2.

To avoid an overly narrow interpretation, administrators should not limit their checks to systems running only release 1.4.2. The recommended action is to upgrade directly to Langflow 1.11.6, identified as the version that fixes all known vulnerabilities in the product.

CVE-2026-0768 is not currently listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. As a result, there is no catalog inclusion date or specific federal remediation deadline for this CVE.

However, the absence of a KEV listing does not mean the vulnerability is not being exploited. In this case, exploitation was directly observed through honeypots, even though no public proof-of-concept exploits for CVE-2026-0768 have been identified.

The traffic originated primarily from Russia, but this alone does not establish attribution. No specific threat group has been identified, and the connections may have originated from compromised servers, proxies, or infrastructure purchased by the attackers.

Attackers Hunt for Langflow, AWS, and OpenAI Secrets

After gaining code execution, attackers perform reconnaissance on the host and query environment variables. This approach is particularly effective against AI applications, which often receive secrets through runtime configuration, .env files, or orchestration systems.

The items targeted include:

• LANGFLOW_SUPERUSER variables;
• variables beginning with the OPENAI_API* prefix;
• AWS_ACCESS* credentials;
• AWS_SECRET* secrets;
• the /root/.cache/langflow/secret_key file;
• the contents of, or access to, the .ssh directory;
• the size and availability of .bash_history.

The theft of an OpenAI key can enable fraudulent API usage, access to resources associated with the account, or queries performed at the victim’s expense. The impact depends on the permissions and services linked to the key.

AWS credentials can have an even broader impact. If they are associated with overly permissive IAM roles, they may provide access to storage, databases, workloads, secret managers, and compute infrastructure.

Langflow superuser tokens are also sensitive. An attacker could use them to alter workflows, read configurations, tamper with components, or establish additional access.

Exposed keys should be treated as compromised even when logs show no immediate use. Attackers may retain and reuse them later from different infrastructure.

How to Look for a Potential Compromise

Applying the update closes the vulnerability but does not remove access that may already have been obtained. On an exposed instance, particularly one reachable from the Internet, patching should be accompanied by incident response activities.

Application and reverse-proxy logs should be reviewed for anomalous requests to validation endpoints, with particular attention to the code and exec_globals parameters. Payloads containing Python instructions, shell commands, filesystem access, or environment-variable enumeration are especially relevant.

The system should also be checked for:

• unexpected reads of /root/.cache/langflow/secret_key;
• access to .ssh and .bash_history;
• Python or shell processes launched by the Langflow service;
• child processes inconsistent with normal operation;
• new users, SSH keys, cron jobs, or other persistence mechanisms;
• files created or modified in unexpected locations;
• outbound connections to unknown destinations;
• changes to containers, images, and persistent volumes.

External services also require review. AWS logs should be analyzed for authentication from unusual IP addresses, regions, and user agents, as well as IAM changes or anomalous data access. For OpenAI, review usage, consumption, and billing associated with keys present on the instance.

Patch, Isolate, and Fully Rotate Credentials

The priority is to upgrade Langflow to version 1.11.6. If an immediate upgrade is not possible, the instance should be removed from public exposure or protected using firewalls, security groups, and reverse-proxy controls.

Validation, automatic authentication, upload, and flow-management endpoints should not be directly accessible from untrusted networks. This reduces the exposed attack surface but does not replace the upgrade.

Following a potential exploitation, at minimum rotate:

1. AWS keys and secrets;
2. OpenAI API keys;
3. Langflow superuser credentials and tokens;
4. local application keys;
5. SSH credentials accessible to the process;
6. any other tokens present in environment variables or configuration files.

IAM permissions should also be reviewed according to the principle of least privilege. If an instance cannot be upgraded or adequately isolated, the safest option is to stop using it.

A Series of Vulnerabilities Already Exploited Against Langflow

CVE-2026-0768 follows several other Langflow vulnerabilities added to CISA’s KEV catalog.

CVE-2026-33017, an RCE in the endpoint used to build public flows, was added to KEV on 2026-03-25, with a federal remediation deadline of 2026-04-08. The vulnerability affects langflow < 1.8.2 and allows attackers to pass Python code embedded in attacker-controlled nodes to exec().

CVE-2026-55255 was added to KEV on 2026-07-07, with remediation required by 2026-07-10. This IDOR vulnerability, fixed in version 1.9.1, allowed an authenticated user to execute flows belonging to other accounts.

CVE-2026-0770, added to KEV on 2026-07-21 with a deadline of 2026-07-24, abuses the exec_globals parameter of the validate endpoint to achieve remote code execution as root. Versions langflow <= 1.7.3 are affected.

CVE-2026-9198 was added to KEV on 2026-08-04, with a remediation deadline of 2026-08-07. The attack chain combines the issuance of SUPERUSER tokens through /api/v1/auto_login with code execution through /api/v1/validate/code; it affects langflow < 1.10.1.

The catalog also includes CVE-2025-3248, added on 2025-05-05 with a remediation deadline of 2025-05-26 and reportedly used in ransomware campaigns.

This sequence demonstrates a concrete operational risk for exposed Langflow deployments. Applying the patch alone is not enough when a root-level RCE has already been exploited: organizations also need secret rotation, forensic triage, and a review of the entire connected infrastructure.