Langflow flaw is now stealing OpenAI and AWS keys

Attackers are exploiting a critical unauthenticated remote-code-execution flaw in Langflow to extract OpenAI API keys, AWS credentials and administrator secrets from exposed installations. The activity targets CVE-2026-0768, a vulnerability in the Python code validator used by Langflow’s custom-component editor.

VulnCheck observed at least 50 exploitation attempts against its U.K. honeypots over a weekend, with most of the attack traffic originating from Russia. Caitlin Condon, the company’s lead security researcher, said the number of observed attacks had risen to 360. The activity does not depend on a public proof-of-concept exploit: Condon said there are currently no known public PoCs for CVE-2026-0768.

The vulnerability was disclosed in January and affects Langflow 1.4.2 and earlier. Exploitation does not require authentication and can provide code execution with root privileges.

“Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size,”

The CVE-2026-0768 vulnerability description identifies the vulnerable validate endpoint as the entry point. Langflow fails to properly validate a user-supplied string in the endpoint’s code parameter before passing it to Python for execution. An attacker can submit code through the validation path without first authenticating to the application.

A compromised Langflow process can be used to inspect its runtime environment, retrieve application secrets and search for credentials that provide access to external services. The variables observed by VulnCheck include Langflow’s superuser credentials, OpenAI API keys and AWS access and secret keys. Probing /root/.cache/langflow/secret_key, SSH access and shell history also indicates that attackers are checking whether the host can provide additional paths into the surrounding environment.

Langflow’s attack surface

Langflow is an open-source, Python-based low-code platform for assembling AI agents, chatbots and retrieval-augmented-generation systems. Its visual editor connects language models, prompts, databases, APIs and other tools, while its source-code access lets developers customize components with Python. User-supplied Python is part of the product’s authoring model, but it must not be treated as trusted code when it reaches a remotely accessible endpoint.

The project’s official GitHub repository documents several deployment paths, including a local Python installation, Docker and Langflow Desktop for Windows and macOS. The quickstart runs the service at http://127.0.0.1:7860, while the documented Docker command publishes port 7860 through docker run -p 7860:7860 langflowai/langflow:latest. A deployment bound only to loopback differs from one exposed through a public interface, but the supplied reporting does not establish how many internet-facing Langflow instances are vulnerable.

The repository also describes built-in API and MCP servers, API and JSON export, multi-agent orchestration, vector-database support and integrations with observability tools including LangSmith and LangFuse. Those capabilities may make more infrastructure and credentials reachable from a compromised workflow host; they do not, by themselves, prove that any specific integration was accessed in this campaign.

The relevant version history, including earlier Langflow flaws mentioned in the reporting, is:

CVE-2026-0768 is part of a series of Langflow vulnerabilities used for code execution, file modification, workflow access, data theft and credential extraction during 2026. The reporting says CVE-2026-33017 was exploited within about a day of disclosure, while the current campaign has no known public PoC.

What Langflow operators should do

Operators running 1.4.2 or earlier should upgrade to Langflow 1.11.6, the version identified in the reporting as addressing all known flaws in the tool. They should also treat any exposed instance as potentially compromised rather than assuming an upgrade alone invalidates stolen credentials.

The credentials specifically targeted in the observed requests are LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*. Incident response should include reviewing and rotating Langflow administrator credentials, OpenAI API keys and AWS access credentials if the vulnerable service was reachable by an attacker. The source material does not provide a confirmed compromise count, a list of affected organizations or evidence that every observed request successfully extracted a secret, so those details remain unresolved.

The GitHub project’s installation guidance requires Python 3.10–3.14 and recommends uv for local installation. It also supports Docker and a desktop package with bundled dependencies. Those options simplify deployment, but they do not remove the need to control network exposure: the flaw is in an application endpoint, not in a package-installation mechanism.

×

Langflow combines arbitrary Python customization, external model APIs, cloud credentials and deployable API or MCP interfaces in one service. A remotely reachable validator that executes input without authentication can turn that service into a credential-harvesting foothold before defenders inspect the workflow itself.