CVE-2026-0768: Active Exploitation of Langflow, 360+ Attacks in Hours

Threat actors are actively exploiting critical vulnerability CVE-2026-0768 in Langflow, an open-source low-code AI orchestration platform. By September 1, 2026, VulnCheck had detected over 360 exploitation attempts against its canaries in the U.K., with traffic originating primarily from Russia. The severity stems from three factors: unauthenticated RCE, execution with root privileges, and the role of AI platforms as concentrators of cloud credentials and sensitive API keys.

The Mechanism: exec/eval Without Filters on the Validation Path

The flaw lies in the code validator of Langflow's custom component editor. Advisory ZDI-26-034 precisely describes the chain: a remote attacker supplies a string to the code parameter of the /api/v1/validate/code endpoint; the string is passed directly to exec/eval without prior validation, allowing arbitrary Python code execution in the context of the root user. No authentication is required.

The NVD record classifies the vulnerability as CWE-94 (Improper Control of Generation of Code Code Injection) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. All Langflow releases up to version 1.4.2 are affected, according to SecurityWeek.

Timeline: From ZDI Reporting to January 2026 Zero-Day

The vulnerability was reported to the vendor via the Zero Day Initiative on July 18, 2025. ZDI publicly disclosed advisory ZDI-26-034 in January 2026 as a zero-day case, listing access restriction as the only mitigation. The roughly six-month gap between reporting and public disclosure did not prevent in-the-wild exploitation from starting with immediate speed once technical details became known.

The contrast between this institutional slowness and attacker speed constitutes one of the recurring patterns of 2026 for AI platforms. According to VulnCheck, cited by SecurityWeek: before 2026 there was evidence of only one Langflow vulnerability exploited in the wild; in 2026, 11 additional vulnerabilities have been targeted and reported as exploited, with a pace of change described as "fast" by the same source.

"Before 2026, evidence showed only one Langflow vulnerability known to be exploited in the wild. In 2026, things have changed fast. We've now seen 11 additional vulnerabilities targeted and reported as exploited in the wild, highlighting increasing attacker interest in Langflow." — VulnCheck, via SecurityWeek

Exploitation by the Numbers: 360 Attempts and Over 15,000 Attacks Across Multiple CVEs

VulnCheck detected over 360 exploitation attempts against its canaries in the U.K. by September 1, 2026. The Hacker News notes that initial detections were around 50 in a few hours on August 30, rising to 360. The traffic comes "primarily from Russia" and hit "exclusively Canaries in the U.K." according to Caitlin Condon, VP of threat research at VulnCheck.

The figure of 15,000 successful attacks — reported by SecurityWeek and The Hacker News — refers, however, to an aggregate of three distinct Langflow vulnerabilities: CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027, not solely to CVE-2026-0768 which is the subject of this article. CVE-2026-0769 also carries CVSS 9.8; CVE-2025-3248 carries CVSS 9.8; CVE-2026-5027 carries CVSS 8.8.

Post-Exploitation Activity: Targeted Reconnaissance for AI and Cloud Credentials

The observed requests are not random attempts but structured reconnaissance and credential-harvesting activity. According to Caitlin Condon, cited by The Hacker News:

"Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size."

The pattern reveals a specific interest in AI service keys (OpenAI) and cloud provider credentials (AWS), typical of self-hosted Langflow deployments. The root privilege allows access to configuration files and shell history that would otherwise be inaccessible.

What to Do Now

• Verify the installed version: all Langflow releases up to 1.4.2 are affected by CVE-2026-0768. Operators must identify whether their instance falls within this range.
• Monitor the /api/v1/validate/code endpoint: the vulnerability's entry point is known and specific; direct logging on this path allows detection of exploitation attempts.
• Isolate internet-exposed instances: the ZDI advisory lists access restriction as mitigation; publicly reachable self-hosted instances present maximum attack surface.
• Review environment variables and persistent secrets: observed activity explicitly targets LANGFLOW_SUPERUSER, OpenAI keys, and AWS credentials; verification of potential prior exposure is necessary even absent confirmation of compromise.

Why Langflow Has Become a Critical Perimeter

AI orchestration platforms like Langflow concentrate credentials from multiple supply chains in a single point of failure: language models (OpenAI), cloud infrastructure (AWS), and administrative access to the platform itself. The low-code model lowers the barrier to adoption but does not always come with visibility into security posture, especially in self-managed deployments.

The escalation from one to twelve Langflow vulnerabilities exploited in the wild in 2026 signals systematic attacker interest, not episodic. The unauthenticated nature and root privilege of CVE-2026-0768 eliminate any initial lateral movement phase: compromise is immediate and total.

The dossier does not specify whether a patch for CVE-2026-0768 is currently available; the ZDI advisory indicates only access restriction as mitigation. The impact on installations outside VulnCheck's U.K. canaries is not quantified, and no specific threat actor group has been identified beyond the geographic indication of the traffic.

Sources

• https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/
• https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html
• https://radar.offseq.com/threat/hackers-start-exploiting-critical-langflow-vulnerability-06d6c6d7f34e707d
• https://nvd.nist.gov/vuln/detail/CVE-2026-0768
• https://cybernews.com/security/critical-langflow-vulnerability-exploited-in-the-wild/
• https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-langflow-n-central-apache-tomcat-flaws/
• https://www.zerodayinitiative.com/advisories/ZDI-26-034/
• https://nvd.nist.gov/vuln/detail/CVE-2026-0769
• https://nvd.nist.gov/vuln/detail/CVE-2025-3248
• https://nvd.nist.gov/vuln/detail/cve-2026-5027
• https://nvd.nist.gov/vuln/detail/cve-2026-34486

Information has been verified against cited sources and is current as of publication.

Sources