Twelve Langflow Flaws Were Exploited This Year. Last Year There Was One.

Before this year, exactly one vulnerability in Langflow had ever been observed exploited in the wild. In 2026 alone the count has reached twelve — and the newest entry is not being used to deploy ransomware or mine cryptocurrency. It is being used to read environment variables.

That detail is the story. CVE-2026-0768, a CVSS 9.8 unauthenticated remote code execution flaw in the low-code AI platform Langflow, came under active attack on August 30. Within days, threat intelligence firm VulnCheck had logged roughly 360 exploitation attempts against its sensor network, and the attackers’ interest was narrow and consistent: Langflow superuser credentials, OpenAI API keys, AWS access and secret keys, the platform’s local secret key file, SSH access, shell history. Not the server. The keys the server holds.

What is affected, and what fixes it

The flaw sits in the code validator behind Langflow’s custom component editor. A user-supplied string reaches Python execution without proper validation, and because Langflow commonly runs as root, an unauthenticated attacker who reaches the endpoint gets code execution in root context. Every Langflow release up to and including version 1.4.2 is affected.

Trend Research analysts Peter Girnus, William Gamazo Sanchez and Alfredo Oliveira reported the bug through Trend Micro’s Zero Day Initiative in July 2025. ZDI published it as ZDI-26-034 in January 2026. A fix exists: BleepingComputer reports that upgrading to version 1.11.6 addresses all currently known flaws in the platform. Eight months passed between disclosure and first observed exploitation — a long grace period that many operators evidently did not use.

VulnCheck saw the first hits against its internet-facing Canary sensors on August 30: more than 50 detections within a few hours, all against sensors in the United Kingdom, with source traffic overwhelmingly from Russian IP space. By Monday the total had climbed to roughly 360.

“Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities,” wrote Caitlin Condon, who leads security research at VulnCheck, in the post that first flagged the activity. She noted that no public proof-of-concept exploit was known to exist — meaning whoever is running this campaign either wrote their own or bought it.

The campaign then broadened. “As of Tuesday, our Canary network has seen exploitation activity from roughly 20 different IPs across more than half a dozen different countries,” Condon told Dark Reading. “We’ve observed a mix of automated scanning, exploitation for initial access, and post-exploitation activity, including ongoing credential and secrets harvesting, lateral movement, and Langflow source code exfiltration.” One operation, run through Python scripts carrying Chinese-language comments, appeared to be hunting for already-backdoored Langflow installations in order to layer its own persistence on top.

Twelve in one year

The pattern matters more than the CVE. In research published days before the attacks began, VulnCheck laid out the trendline: “Before 2026, evidence showed only one Langflow vulnerability known to be exploited in the wild. In 2026, things have changed fast. We’ve now seen 11 additional vulnerabilities targeted and reported as exploited in the wild.” CVE-2026-0768 makes twelve.

The volume behind those twelve is substantial. VulnCheck counts more than 15,000 successful exploitation attempts for just three of the flaws — CVE-2026-0769, CVE-2025-3248 and CVE-2026-5027. Roughly 7,000 Langflow instances sit exposed on the public internet, with vulnerable hosts concentrated in the United States, Germany, Malaysia, Brazil and India. CISA has already ordered federal agencies to patch several earlier Langflow flaws, including CVE-2026-0770 and CVE-2026-55255. As of publication, sources do not show CVE-2026-0768 in the federal KEV catalog, though VulnCheck added it to its own. Outlets draw the tally slightly differently — The Hacker News counted “as many as 12 vulnerabilities since 2025,” folding the pre-2026 flaw into the twelve — but the direction of the curve is not in dispute.

Why the AI stack is the target

An AI orchestration framework is an unusually rich thing to compromise, and not because of what it computes. Langflow, which IBM acquired in 2025 through its purchase of DataStax, is glue: it connects language models, vector stores, databases, internal APIs and increasingly MCP servers into working agents. To do that job it must hold the credentials for all of them — an organization’s OpenAI key, its cloud access keys, its database passwords and its internal service tokens, in one process environment.

That makes these platforms credential infrastructure wearing the costume of developer tooling. An attacker who lands on a Langflow box does not need to move laterally in the traditional sense — the lateral movement has been pre-staged in the form of secrets that authenticate to systems the Langflow host never touches. Rotating credentials after such an intrusion is not optional cleanup. It is the remediation.

The governance failure compounds it. Langflow is designed to be deployed as an internet-accessible service, and low-code AI tooling gets adopted precisely because it lowers the barrier to entry — so it is frequently stood up outside change management, with default secret keys, on infrastructure security never inventoried. VulnCheck notes the vendor publishes hardening guidance that newly onboarded users routinely skip. The result is an internet-facing, root-privileged, credential-dense service that nobody owns. Downstream, compromising an orchestration layer yields access not to one system but to every service its agents were authorized to call — a wider blast radius than most asset inventories model.

What to watch, and what to do

Watch whether CVE-2026-0768 lands in CISA’s KEV catalog with a federal deadline, whether a public exploit surfaces, and whether today’s credential harvesting converts into intrusions using stolen cloud keys weeks from now.

“Adversaries are opportunistically targeting internet-exposed Langflow installations, underscoring the importance of minimizing exposure wherever possible,” Condon said.

The checklist is short. Upgrade to Langflow 1.11.6. Take instances off the public internet, behind a VPN or an authenticating proxy. Set a non-default secret key and apply the vendor’s controls for limiting arbitrary code execution. Review logs for unusual requests touching environment variables, secret files, SSH directories or shell history. And if an instance was reachable and unpatched, rotate everything it held — Langflow superuser credentials, cloud access keys, model provider API keys, database passwords and the instance secret key. Patching closes the door. It does not recall the keys already taken.