cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Attackers Exploit Critical Langflow Remote Code Execution Flaw

· Original article ↗

Summary

VulnCheck reports attackers exploiting unauthenticated RCE flaw CVE-2026-0768 in Langflow releases through 1.4.2, with activity including reconnaissance and credential harvesting.

Key points

  • CVE-2026-0768 (CVSS 9.8) affects Langflow releases up to and including 1.4.2.
  • The flaw is in the custom component editor’s code validator: an unvalidated user-supplied string can enable unauthenticated arbitrary Python code execution as root.
  • VulnCheck says attackers are using the flaw for reconnaissance and credential harvesting, including queries for environment variables, secret keys, and SSH access.
  • VulnCheck observed more than 360 exploitation attempts against its UK canaries; it said activity mainly originated from Russia.
  • The flaw was reported through ZDI in July 2025 and publicly disclosed as a zero-day in January 2026.
  • VulnCheck also reported more than 15,000 successful attacks against Langflow instances vulnerable to CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.

Article Details

Vulnerability Types
  • Remote code execution
  • Improper input validation
Severity
Critical (CVSS 9.8)
Affected Versions
  • Langflow releases up to version 1.4.2
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unknown

MITRE ATT&CK

T1059.006 · PythonThe vulnerability allows attackers to execute arbitrary Python code as root.T1190 · Exploit Public-Facing ApplicationAttackers are exploiting a remote code execution vulnerability in the Langflow platform.

CVE

CVE-2025-3248VulnCheck has seen more than 15,000 attacks successfully exploiting Langflow instances vulnerable to three of the known exploited flaws, namely CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.CVE-2026-0768Tracked as CVE-2026-0768 (CVSS score of 9.8), the security defect exists within the code validator in Langflow’s custom component editor.CVE-2026-0769VulnCheck has seen more than 15,000 attacks successfully exploiting Langflow instances vulnerable to three of the known exploited flaws, namely CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.CVE-2026-5027VulnCheck has seen more than 15,000 attacks successfully exploiting Langflow instances vulnerable to three of the known exploited flaws, namely CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027.

Products

LangflowThreat actors have started exploiting a critical-severity remote code execution (RCE) vulnerability in the AI low-code platform Langflow, vulnerability intelligence firm VulnCheck warns.

Countries

RussiaThe cybersecurity firm observed queries for environment variables, secret keys, and SSH access, mainly originating from Russia. By Monday, VulnCheck had seen over 360 exploitation attempts hitting its canaries in the UK.United KingdomThe cybersecurity firm observed queries for environment variables, secret keys, and SSH access, mainly originating from Russia. By Monday, VulnCheck had seen over 360 exploitation attempts hitting its canaries in the UK.

Related Articles