Critical Langflow Vulnerability Exploited to Steal OpenAI and AWS Keys

Attackers are exploiting a critical Langflow vulnerability to steal credentials, tokens and cloud secrets from exposed servers, including OpenAI API keys and AWS access keys.

The flaw, tracked as CVE-2026-0768, affects Langflow versions 1.4.2 and earlier. It allows unauthenticated attackers to run arbitrary code with root privileges.

Attacks target exposed Langflow servers

VulnCheck detected exploitation attempts against its UK honeypots over the weekend. Researchers initially recorded at least 50 attacks, but the total later rose to 360.

Most observed traffic came from Russia, according to VulnCheck lead security researcher Caitlin Condon.

Attackers use the Langflow vulnerability to inspect environment variables and look for valuable credentials. Their requests target Langflow administrator credentials, OpenAI API keys and AWS access and secret keys.

They also attempt to read Langflow secret keys, inspect SSH access and check shell history files. These actions could help attackers gain persistent access or move deeper into affected environments.

Flaw allows unauthenticated code execution

Langflow is an open-source, Python-based low-code platform for building AI applications, agents, chatbots and retrieval-augmented generation systems.

Users create workflows through a graphical interface that connects language models, prompts, databases, APIs and other components.

The vulnerability affects Langflow’s custom component editor. Specifically, the platform fails to properly validate code sent to a validation endpoint before it executes the supplied Python code.

That weakness gives an unauthenticated attacker a path to execute commands as root. Researchers have not identified a public proof-of-concept exploit for CVE-2026-0768.

Langflow users should update now

CVE-2026-0768 is the latest in a series of actively exploited Langflow flaws this year.

Attackers previously abused other critical vulnerabilities to execute Python scripts, access AI workflows, collect environment and database files, write files to servers and deploy second-stage implants.

Langflow users should upgrade to version 1.11.6, which addresses the known security issues. Organisations should also rotate exposed API keys, AWS credentials and other secrets, then review affected systems for suspicious activity.