CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Langflow, code-parameter code injection RCE in the validate endpoint, renewed mass exploitation since August 2026

cve · CVE-2026-0768

Coverage
1
first 2026-09-03 → last 2026-09-03
Latest activity
2026-09-03
A months-old, already-patched Langflow RCE draws 360 attack attempts in days once honeypots start counting
Peak priority
high
1 high
Targets
technology
sectors: technology, public-sector, education
Sources cited
5
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-0768, newest first. Check the date before acting on an older one.

  • Upgrade every self-hosted Langflow instance to the current release (1.12.0) now if still running any version at or below 1.4.2; where AWS or OpenAI credentials were configured as environment variables on an exposed instance, rotate them and check for outbound API usage from unfamiliar sources.
    2026-09-03CVE-2026-0768

Defender insights

What each entry about CVE-2026-0768 tells a defender to do, newest first.

2026-09-03HIGHexploitedA months-old, already-patched Langflow RCE draws 360 attack attempts in days once honeypots start counting

Triage

Story timeline

  1. 2026-09-03CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables
    trending-vulnerabilitiesA months-old, already-patched Langflow RCE draws 360 attack attempts in days once honeypots start counting

Hunting pivots

Affected products
Langflow
Tags
actively-exploitedai-abusepatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Credential AccessUnsecured Credentials: Credentials In Files

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-03/cve-2026-0768-langflow-renewed-mass-exploitation · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-09-03/cve-2026-0768-langflow-renewed-mass-exploitation · ATT&CK page ↗

Entries about Langflow, code-parameter code injection RCE in the validate endpoint, renewed mass exploitation since August 2026 (1)

2026-09-03 · view entry permalink →

HIGHCVE-2026-0768exploitedNATOB2

CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables

Langflow is a self-hosted AI-workflow/agent-building platform whose custom-component validate endpoint has now produced several distinct remote-code-execution CVEs in 2026. CVE-2026-0768 (CVSS 9.8, CWE-94 code injection) sits in the endpoint's handling of the code parameter: the flaw lacks proper validation of a user-supplied string before using it to execute Python code, with no authentication required and execution running as root. Disclosed by Trend Micro's Zero Day Initiative (ZDI-26-034) in January 2026, it is a genuinely separate vulnerability from CVE-2026-0770, a companion 0-day disclosed by the same research team on the same date, hitting the exec_globals parameter on the same endpoint via a different CWE class (untrusted-sphere inclusion), and has been KEV-listed since July (Zero Day Initiative, ZDI-26-036). VulnCheck's honeypots (via Caitlin Condon) recorded at least 50 exploitation attempts against CVE-2026-0768 over one weekend, primarily from Russian source traffic, rising to 360 total attacks as of BleepingComputer's reporting, with no known public proof-of-concept (BleepingComputer, 2026-09-01). Post-exploitation requests query environment variables LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size, a hunt signature that generalises to Langflow-adjacent exploitation regardless of which specific CVE is chased (BleepingComputer, 2026-09-01). heise's follow-up the next day independently confirms sustained, rising attack volume (heise Security, 2026-09-02). The current Langflow release is 1.12.0 (heise Security, 2026-09-02), which superseded 1.11.6 (the version BleepingComputer's 2026-09-01 report names as current) released later the same day per Langflow's own GitHub release history (Langflow GitHub Releases); the underlying fix for CVE-2026-0768 applies to any version after the affected 1.4.2 baseline, so 1.12.0 is simply the latest of many fixed releases rather than where the fix was newly introduced.

Triage: requests to the validate endpoint's code parameter that immediately follow with reads of /root/.cache/langflow/secret_key or environment-variable enumeration are the observable exploitation-and-harvest sequence; a legitimate custom-component workflow does not chain those two actions together.

Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size

VulnCheck (Caitlin Condon), via BleepingComputer

Die Sicherheitsforscher geben an, mittlerweile mehr als 350 Angriffsversuche beobachtet zu haben – Tendenz steigend.

heise Security 2026-09-02

Builds on: CISA KEV-lists a third Langflow RCE as IBM patches 15 more, including an unauthenticated…

vulnerability03 Sep 05:20Zmulti-sourceOpen finding →
Sources: BleepingComputer · heise Security · Zero Day Initiative (Trend Micro) · Langflow (GitHub Releases)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • zerodayinitiative.com2 (40%)
  • bleepingcomputer.com1 (20%)
  • github.com1 (20%)
  • heise.de1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)