Security researchers have identified an active exploitation campaign targeting **Langflow**, a popular open-source, Python-based low-code platform for developing AI applications. ### Unauthenticated RCE Puts AI Credentials at Risk At the heart of this campaign is **CVE-2026-0768**, an unauthenticated remote code execution (RCE) vulnerability with a critical severity rating. The flaw resides within the code validator of **Langflow**'s custom component editor, allowing attackers to execute arbitrary code with root privileges without needing authentication. Threat intelligence company **VulnCheck** initially detected the activity on its honeypots in the U.K., observing at least 50 exploitation attempts over a single weekend. **VulnCheck** lead security researcher **Caitlin Condon** noted a rapid escalation, with the total number of observed attacks surging to 360, primarily originating from Russia. ### Reconnaissance and Credential Harvesting According to **Condon**, the attackers are conducting reconnaissance and querying environment variables to harvest administrative credentials or superuser authentication keys for **Langflow** instances, **AWS** secrets, and **OpenAI** API keys. "Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size," **Condon** explained. ### The Vulnerability's Technical Details **CVE-2026-0768** was publicly disclosed in January and affects **Langflow** versions 1.4.2 and earlier. The vulnerability's description highlights that "The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code." **Trend Micro**’s **Zero Day Initiative** further elaborates that this lack of proper validation enables attackers to execute Python code via a user-supplied string. ### A Pattern of Exploitation for Langflow This is not the first time **Langflow** has been targeted. In March, attackers swiftly leveraged **CVE-2026-33017**, a critical code-injection flaw, within a day of its disclosure to execute Python scripts and extract `.ENV` and database files. Subsequent attacks exploited **CVE-2026-5027** for arbitrary file writes and **CVE-2026-55255** for authentication bypass, leading to access to other users' AI workflows, data theft, and the deployment of second-stage implants. Attackers also exploited **CVE-2026-0770** to execute commands with root privileges, attempting to deploy malware and extract cloud credentials, environment variables, and container metadata. More recently, **CISA** warned about active exploitation of **CVE-2026-9198** after public proof-of-concept exploits emerged. ### Remediation **Langflow** users are strongly advised to upgrade to the latest available version, 1.11.6, which includes patches for all known vulnerabilities in the platform. Proactive patching is crucial to mitigate the significant risks posed by these active exploitation campaigns.