A critical flaw in the AI workflow tool Langflow has been under active attack since late August. CVE-2026-0768 (CVSS 9.8) lets unauthenticated attackers run arbitrary code as root over the network – and there is still no vendor patch that specifically closes the hole.
Why the flaw is so dangerous
The bug lives in the code validator of Langflow’s custom component editor. The validate endpoint accepts a user-supplied string via the code parameter and runs it as Python without adequate checks. With no authentication required, network access to an exposed instance is enough to run commands as root. Trend Micro’s Zero Day Initiative (ZDI-26-034) reported it in July 2025 and published it as a zero-day in January 2026.
Hundreds of exploit attempts within hours
On 30 August 2026 the security firm VulnCheck logged the first exploit attempts – about 50 at first, climbing to roughly 360 over the weekend. The attackers focus on reconnaissance and credential harvesting: they query environment variables such as LANGFLOW_SUPERUSER along with OpenAI and AWS keys, and read files like /root/.cache/langflow/secret_key. Most of the traffic originates from Russia, according to VulnCheck. Unlike several other Langflow flaws, CVE-2026-0768 is not on the CISA KEV catalog so far.
Why this matters beyond Langflow
Langflow typifies a whole class of self-hosted AI building kits that users spin up quickly and often without hardening. Such servers hoard API keys and secrets that turn a single box into a springboard for wider attacks. With no dedicated fix available, the ZDI cites restricting access to the product as the only reliable measure:
- Affected: all Langflow releases up to and including 1.4.2 (no vendor patch specific to CVE-2026-0768 has been confirmed)
- Never expose Langflow directly to the internet – run it behind a VPN, auth proxy or WAF
- Update to the current maintained Langflow release and audit logs for suspicious validate requests carrying Python code
- Immediately rotate any exposed secrets (OpenAI, AWS, superuser credentials)
Sources: Zero Day Initiative (ZDI-26-034), SecurityWeek, The Hacker News, OpenCVE.
