Attackers Are Turning Exposed Langflow Servers Into Credential Farms
CVE-2026-0768 is a critical, actively exploited remote code execution flaw in Langflow being used since September 2026 to steal API keys and cloud credentials from exposed AI servers. What happened, why it matters, and how to respond.
News Report
What happened
A critical flaw in Langflow, the widely used open-source builder for AI agents and workflows, is being exploited in the wild to run code on exposed servers and steal the API keys and cloud credentials those servers hold. Tracked as CVE-2026-0768 and rated 9.8 on the CVSS scale, it lets an unauthenticated attacker reach Python's exec() through Langflow's custom-component editor. A user-supplied code parameter passes into the /validate endpoint without sanitization and executes as root.
The bug is not new on paper. It was reported through Trend Micro's Zero Day Initiative in July 2025 and published on January 9, 2026. What changed is the traffic. Researchers confirmed active exploitation on September 1, 2026, after detections climbed from roughly 50 within hours of the first probes on August 30 to about 360 by the following Monday. The vulnerable code sits in every Langflow release before 1.4.2.
Why an exposed instance is now a breach
For anyone running a low-code AI framework in production, this is the line the story crosses. Pre-2026, leaving a Langflow instance reachable from the internet was a hygiene problem you meant to get to. As of September 2026, any exposed instance should be treated as already compromised, and every secret it could see should be rotated.
The reason is what these tools sit on top of. A Langflow server that orchestrates agents needs the keys to do the work: OpenAI and Anthropic tokens, AWS, GCP and Azure credentials, database connection strings. Attackers have noticed. The activity researchers describe is not smash-and-grab but "quiet, persistent credential extraction" aimed squarely at those secrets, which turns a compromised builder into a supply of working keys rather than a single defaced box.
How the attack works after the break-in
Post-exploitation, the recon is targeted rather than generic. Compromised hosts are queried for environment variables named LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, and the file /root/.cache/langflow/secret_key is read directly. The intruders also check SSH access and the size of the shell history, the sort of look-around that tells them how much of the network the box can reach.
Then the payloads land: Python-based credential harvesters, proxy agents, SimpleHelp remote-access tooling and Monero cryptominers. Some intrusions clean up after themselves, disabling auditd and dropping a .sysd file to frustrate forensics. The traffic mostly originates from Russia, with probe hits also seen from the United Kingdom, Singapore and Israel, and one command-and-control channel running from a France-based address to a host in Israel. Most of the exposed, vulnerable servers themselves sit in the United States, Germany, Malaysia, Brazil and India.
The 12th CVE, and the pattern behind it
The single vulnerability is alarming; the trend around it is the actual news. By the Forkast analysis that first framed it this way, CVE-2026-0768 is the 12th distinct Langflow flaw exploited in the wild during 2026, set against more than 15,000 exploitation attempts across that portfolio over the year. Before 2026, exactly one Langflow CVE had ever been exploited in the wild. One campaign on June 25, 2026 went after roughly 7,000 servers in a single sweep.
Langflow is not alone in the pattern. In the same window, attackers were separately hammering a critical Ruby on Rails flaw nicknamed "KindaRails2Shell" (CVE-2026-66066, CVSS 9.5), an unauthenticated file-read bug used to lift Rails master keys, database passwords and cloud credentials from more than 7,100 exposed instances. Different stack, same prize: the secrets a web application keeps in reach.
What to do now
The immediate fix is the obvious one. Patch Langflow to 1.4.2 or later, and do not expose the admin interface to the open internet in the first place. Restrict network access to the instance, enforce authentication at the network edge, and disable the LANGFLOW_AUTO_LOGIN feature that leaves the door unlatched.
The harder fix is architectural, and it outlasts this CVE. Static keys sitting in environment variables are exactly what the recon scripts read; brokered, short-lived credentials from a vault or a cloud KMS give an attacker far less to steal and a much shorter window to use it. And if an instance was reachable while unpatched, patching does not undo what may already have been read. Assume the keys it touched are gone and rotate them. The next Langflow bug, on this year's evidence, is a question of when.
