CTIPilot

Langflow, code-parameter code injection RCE in the validate endpoint, renewed mass exploitation since August 2026

cve · CVE-2026-0768

Coverage timeline
1
first 2026-09-03 → last 2026-09-03
Peak priority
high
1 high
Sources cited
5
4 hosts
Sections touched
1
trending-vulnerabilities
Co-occurring entities
1
see Co-occurring entities below
ATT&CK techniques
2
pinned v19.2 · see below

Hunting pivots

ATT&CK techniques
T1190T1552.001
Affected products
Langflow
Tags
actively-exploitedai-abusepatch-availablepre-authrcevulnerabilities

ATT&CK techniques

2 techniques observed across 1 entry, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-03/cve-2026-0768-langflow-renewed-mass-exploitation · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-09-03/cve-2026-0768-langflow-renewed-mass-exploitation · ATT&CK page ↗

Story timeline

  1. 2026-09-03CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables
    trending-vulnerabilitiesA months-old, already-patched Langflow RCE draws 360 attack attempts in days once honeypots start counting

Where this entity is cited

  • trending-vulnerabilities1

Source distribution

  • zerodayinitiative.com2 (40%)
  • bleepingcomputer.com1 (20%)
  • github.com1 (20%)
  • heise.de1 (20%)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (5)

Entries about Langflow, code-parameter code injection RCE in the validate endpoint, renewed mass exploitation since August 2026 (1)

2026-09-03 · view entry permalink →

HIGHCVE-2026-0768exploitedNATOB2

CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables

Langflow is a self-hosted AI-workflow/agent-building platform whose custom-component validate endpoint has now produced several distinct remote-code-execution CVEs in 2026. CVE-2026-0768 (CVSS 9.8, CWE-94 code injection) sits in the endpoint's handling of the code parameter: the flaw lacks proper validation of a user-supplied string before using it to execute Python code, with no authentication required and execution running as root. Disclosed by Trend Micro's Zero Day Initiative (ZDI-26-034) in January 2026, it is a genuinely separate vulnerability from CVE-2026-0770, a companion 0-day disclosed by the same research team on the same date, hitting the exec_globals parameter on the same endpoint via a different CWE class (untrusted-sphere inclusion), and has been KEV-listed since July (Zero Day Initiative, ZDI-26-036). VulnCheck's honeypots (via Caitlin Condon) recorded at least 50 exploitation attempts against CVE-2026-0768 over one weekend, primarily from Russian source traffic, rising to 360 total attacks as of BleepingComputer's reporting, with no known public proof-of-concept (BleepingComputer, 2026-09-01). Post-exploitation requests query environment variables LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size, a hunt signature that generalises to Langflow-adjacent exploitation regardless of which specific CVE is chased (BleepingComputer, 2026-09-01). heise's follow-up the next day independently confirms sustained, rising attack volume (heise Security, 2026-09-02). The current Langflow release is 1.12.0 (heise Security, 2026-09-02), which superseded 1.11.6 (the version BleepingComputer's 2026-09-01 report names as current) released later the same day per Langflow's own GitHub release history (Langflow GitHub Releases); the underlying fix for CVE-2026-0768 applies to any version after the affected 1.4.2 baseline, so 1.12.0 is simply the latest of many fixed releases rather than where the fix was newly introduced.

Triage: requests to the validate endpoint's code parameter that immediately follow with reads of /root/.cache/langflow/secret_key or environment-variable enumeration are the observable exploitation-and-harvest sequence; a legitimate custom-component workflow does not chain those two actions together.

Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size

VulnCheck (Caitlin Condon), via BleepingComputer

Die Sicherheitsforscher geben an, mittlerweile mehr als 350 Angriffsversuche beobachtet zu haben – Tendenz steigend.

heise Security 2026-09-02

Builds on: 2026-07-22/langflow-cve-2026-0770-exploited-ncsc-nl-15-cve-batch

vulnerability03 Sep 05:20Zmulti-sourceOpen finding ↗
Sources: BleepingComputer · heise Security · Zero Day Initiative (Trend Micro) · Langflow (GitHub Releases)