Langflow RCE Is Being Exploited to Steal AI and Cloud Credentials

• The Mess: Attackers are actively exploiting a critical Langflow vulnerability that allows unauthenticated remote code execution as root. The attacks are already probing for OpenAI credentials, AWS keys, Langflow secrets and SSH access.
• The Damage: A compromised Langflow server can become a credential warehouse, giving attackers access to the AI services and cloud infrastructure connected to it.
• The Fix: Upgrade Langflow to a version that is not affected by CVE-2026-0768 and assume an exposed vulnerable instance may already have been probed or compromised.

AI infrastructure has a new problem.

Attackers aren’t just trying to break the AI.

They’re trying to steal everything the AI server can access.

CVE-2026-0768 affects Langflow, an open-source platform used to build AI agents and workflows.

The vulnerability has a CVSS score of 9.8 and allows an unauthenticated attacker to execute arbitrary Python code in the context of the root user.

And now attackers are actively using it.

No Login Required

The vulnerable functionality is the code validation endpoint.

Langflow accepts user-controlled input and processes it as Python code without adequate validation.

That’s the entire problem.

An attacker doesn’t need:

• a valid Langflow account
• administrator credentials
• an existing session
• user interaction

They need network access to a vulnerable Langflow instance.

Then the application executes their code.

As root.

The Attackers Aren’t Looking for a Calculator

The interesting part of the current exploitation isn’t simply the RCE.

It’s what happens after attackers get execution.

VulnCheck has observed attackers querying environment variables containing names such as:

LANGFLOW_SUPERUSER

OPENAI_API*

AWS_ACCESS*

AWS_SECRET*

They’re also looking for the Langflow secret key and checking SSH-related files.

That’s a very different attack from simply dropping malware.

The server itself is the target.

But the credentials stored around it are the prize.

Your AI Server May Hold Cloud Keys

This is where Langflow becomes particularly interesting.

An AI workflow server may have access to:

• OpenAI API keys
• cloud credentials
• database credentials
• internal APIs
• Git repositories
• storage buckets
• SSH keys
• application secrets

The attacker doesn’t necessarily need to compromise every connected service individually.

They can compromise the machine that already has permission to talk to them.

That’s a much shorter attack chain.

Root Makes It Worse

Remote code execution is bad.

Remote code execution as root is worse.

Once the vulnerable process is running attacker-controlled code with root privileges, the attacker can potentially modify the host, deploy persistence, steal credentials and use the machine as a launch point for additional attacks.

The vulnerability therefore isn’t simply:

AI application compromised.

It’s potentially:

AI application → Linux host → credentials → cloud → internal infrastructure.

Exploitation Is Already Happening

This isn’t a theoretical PoC sitting quietly on GitHub.

VulnCheck reported more than 360 exploitation attempts against its canary systems by Monday, after recording more than 50 detections within just a few hours on August 30.

The observed traffic was primarily originating from Russia and targeted canary systems in the United Kingdom.

That is the part administrators should care about.

The vulnerability is old enough to have been disclosed earlier this year.

But the exploitation activity is happening now.

Langflow Has Become an Attractive Target

CVE-2026-0768 isn’t an isolated event.

VulnCheck says it has observed a sharp increase in attacks against Langflow during 2026.

Multiple Langflow vulnerabilities have already been exploited in the wild, with more than 15,000 successful attacks involving three previously exploited vulnerabilities.

That suggests attackers are actively scanning for exposed Langflow installations.

And they aren’t necessarily looking for sophisticated targets.

They’re looking for machines that forgot to get patched.

The Credential Harvesting Is the Real Story

An RCE vulnerability gets the headline.

Credential harvesting gets the persistence.

Imagine an attacker compromises a Langflow server and finds:

OPENAI_API_KEY

AWS_SECRET_ACCESS_KEY

LANGFLOW_SUPERUSER

and an SSH configuration.

The original vulnerability has now become irrelevant.

The attacker has potentially obtained credentials that can be reused elsewhere.

That’s how a vulnerability in an AI workflow application can turn into a broader cloud compromise.

Don’t Assume the Server Is Clean After Patching

If a vulnerable Langflow instance was exposed to the Internet, simply installing the update isn’t enough.

Investigate it.

Look for:

• unexpected processes
• new users
• modified SSH files
• unknown API keys
• suspicious environment variables
• unusual outbound connections
• recently created files
• unexpected cron jobs
• shell history changes
• persistence mechanisms

The current exploitation activity specifically shows attackers looking for credentials and SSH access.

That means defenders should investigate those areas first.

The Internet Exposure Problem

Langflow is useful precisely because it provides a web interface for building and managing AI workflows.

That also makes careless Internet exposure dangerous.

An AI development platform doesn’t need to be publicly reachable just because developers need remote access to it.

Put it behind:

• VPN
• access controls
• reverse proxy authentication
• network segmentation
• firewall restrictions

And remove unnecessary public exposure.

A critical unauthenticated RCE should never be sitting directly on the Internet waiting for a scanner.

Patch the AI Stack

AI security isn’t just about prompt injection.

It isn’t just about malicious models.

It isn’t just about data poisoning.

The infrastructure running the AI workflow can have ordinary, brutally effective vulnerabilities.

A Python code-injection bug doesn’t care that the application happens to be called an AI platform.

It’s still an Internet-facing server.

And if that server contains cloud credentials, the attacker doesn’t need to attack the model.

They can simply steal the keys.

Bugstoday Opinion

This is the kind of AI vulnerability we should be paying attention to.

Not because the bug is somehow magical.

It’s actually painfully ordinary:

attacker-controlled input becomes Python code.

The interesting part is where that code runs.

Langflow servers can sit next to OpenAI credentials, AWS keys, SSH access and other infrastructure secrets.

That makes the vulnerable server far more valuable than the application itself.

Bugstoday verdict: if you run Langflow and expose it to the Internet, treat CVE-2026-0768 as an emergency. Patch it, investigate the host and rotate credentials that may have been accessible to the process. The attackers aren’t merely checking whether Langflow is vulnerable. They’re already looking through the machine for the keys to everything else.

Today’s Bugs. Tomorrow’s Breaches.

Sources

• ZDI — ZDI-26-034 / CVE-2026-0768
• NVD — CVE-2026-0768
• CVE.org — CVE-2026-0768
• VulnCheck — Langflow exploitation research
• GitHub Advisory Database — CVE-2026-0768