Critical Langflow Flaw (CVE-2026-0768) Now Exploited en Masse to Steal OpenAI & AWS Keys

A critical remote-code-execution flaw in Langflow — the popular low-code builder for LLM apps and AI agents — is under mass active exploitation. Tracked as CVE-2026-0768 (CVSS 9.8), it lets an unauthenticated attacker run arbitrary Python as root, and the payloads are going straight for what makes an AI platform valuable: OpenAI API keys and cloud secrets.

What happened

Security researchers at VulnCheck reported a sharp spike in exploitation of CVE-2026-0768 in early September 2026. Their UK honeypots logged roughly 50 exploitation attempts over a single weekend, climbing to about 360 as the campaign scaled, with traffic originating primarily from Russia. Multiple vendors — BleepingComputer, SecurityWeek and Dark Reading — confirmed the attacks are opportunistic and internet-wide.

How the flaw works

Langflow ships a visual editor for building custom components. Its code validator takes a user-supplied string and passes it to Python's exec() without sanitising it and without requiring authentication. That is the whole bug: an endpoint meant to validate a snippet will instead run whatever you send it, as the process user — commonly root in default container deployments. No login, no token, no trick — just a POST to an exposed instance.

The flaw affects Langflow versions 1.4.2 and earlier and was first disclosed in January 2026; the fix landed in 1.5.0. What is new in September is the exploitation: the patch has been public for months, exposed instances have not been updated, and attackers have automated the rest.

Why AI teams should care more, not less

Commentators have started calling AI frameworks the new credential-harvesting infrastructure, and this campaign shows why. Once the attacker has code execution, the objective is not to deface the app — it is to read the environment. An LLM orchestration platform's environment is unusually rich: it holds the OpenAI, Anthropic and cloud provider keys the app uses to call models, plus the Langflow superuser secret itself. Steal those and you get free inference on someone else's bill, access to whatever data those models can reach, and a foothold for lateral movement. This is the same lesson as the LiteLLM and RAGFlow key-theft campaigns: the AI gateway is where the keys live.

What to do now

• Patch immediately to Langflow 1.5.0 or later. If you cannot patch today, take exposed instances off the public internet — put them behind authentication or a VPN.
• Assume compromise if you were exposed. A public, unpatched instance before this weekend should be treated as breached: rotate every OpenAI/Anthropic key, every cloud credential, and the Langflow secret, and review provider billing for anomalous inference spend.
• Find your exposed AI surface. Most teams do not know which AI services are reachable from the internet. Our free AI Footprint Scanner maps that surface, and the LLM Security (OWASP) checklist walks the LLM-specific failure modes CVE-2026-0768 exemplifies.
• Treat the framework as a dependency. Langflow is now on its 12th exploited CVE — inventory it, version it, and monitor it like any other supply-chain component with a package/supply-chain scan and an AI Bill of Materials.

Sources

• BleepingComputer — Critical Langflow flaw exploited to steal OpenAI and AWS keys
• SecurityWeek — Hackers Start Exploiting Critical Langflow Vulnerability
• Dark Reading — Critical Langflow Flaw Exploited as Attacks on AI Platform Rise