Attackers Exploit Langflow RCE Flaw to Steal OpenAI and AWS Credentials
Summary
VulnCheck observed 360 attempts to exploit Langflow CVE-2026-0768, an unauthenticated RCE flaw affecting versions 1.4.2 and earlier. Attackers targeted environment variables and secret files; users are urged to upgrade to 1.11.6.
Key points
- CVE-2026-0768 allows unauthenticated arbitrary code execution with root privileges through the custom component editor’s code validator.
- The flaw affects Langflow versions 1.4.2 and earlier.
- VulnCheck observed at least 360 exploitation attempts on its honeypots; attack traffic originated primarily from Russia.
- Requests sought Langflow superuser credentials, AWS secrets, OpenAI API keys, environment variables, and the Langflow secret key.
- VulnCheck researcher Caitlin Condon said there were no known public proof-of-concept exploits.
- Users are advised to upgrade to Langflow 1.11.6, which the article says addresses all known flaws.
Article Details
- Vulnerability Types
- Improper input validation leading to unauthenticated remote code execution
- Code injection
- Severity
- Critical
- Affected Versions
- Langflow 1.4.2 and earlier
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
MITRE ATT&CK
T1005 · Data from Local SystemAttackers read Langflow's secret_key file and query local environment data to collect credentials and keys.T1059.006 · PythonThe flaw lets attackers execute Python code through Langflow's code validator.T1083 · File and Directory DiscoveryAttacker requests check .ssh access and the size of .bash_history during reconnaissance.T1190 · Exploit Public-Facing ApplicationAttackers exploit CVE-2026-0768 in Langflow to gain unauthenticated remote code execution.T1552.001 · Credentials In FilesAttackers seek credentials in the /root/.cache/langflow/secret_key file.
CVE
CVE-2026-0768Threat actors are actively exploiting CVE-2026-0768 in Langflow to gain unauthenticated remote code execution and steal credentials, tokens, and keys from vulnerable AI application environments.CVE-2026-0770Attackers also exploited CVE-2026-0770 to execute commands with root privileges and attempted to deploy malware and extract cloud credentials, environment variables, and container metadata.CVE-2026-33017In March, attackers leveraged CVE-2026-33017, a critical code-injection flaw, within about a day of its disclosure, and used it to execute Python scripts and to harvest .ENV and database files.CVE-2026-5027This was followed by attacks exploiting CVE-2026-5027 to write arbitrary files to vulnerable servers and CVE-2026-55255 to access other users’ AI workflows, steal sensitive data, and deliver second-stage implants.CVE-2026-55255This was followed by attacks exploiting CVE-2026-5027 to write arbitrary files to vulnerable servers and CVE-2026-55255 to access other users’ AI workflows, steal sensitive data, and deliver second-stage implants.CVE-2026-9198More recently, CISA warned that CVE-2026-9198 was being exploited after multiple proof-of-concept exploits became publicly available.
People
Vendors
Amazon Web ServicesVulnCheck observed escalating attacks against honeypots, with the attacker targeting environment variables and secret files to collect Langflow, AWS, and OpenAI credentials.OpenAIVulnCheck observed escalating attacks against honeypots, with the attacker targeting environment variables and secret files to collect Langflow, AWS, and OpenAI credentials.VulnCheckVulnCheck observed escalating attacks against honeypots, with the attacker targeting environment variables and secret files to collect Langflow, AWS, and OpenAI credentials.