CVE-2026-0768, Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables

Langflow is a self-hosted AI-workflow/agent-building platform whose custom-component validate endpoint has now produced several distinct remote-code-execution CVEs in 2026. CVE-2026-0768 (CVSS 9.8, CWE-94 code injection) sits in the endpoint's handling of the code parameter: the flaw lacks proper validation of a user-supplied string before using it to execute Python code, with no authentication required and execution running as root. Disclosed by Trend Micro's Zero Day Initiative (ZDI-26-034) in January 2026, it is a genuinely separate vulnerability from CVE-2026-0770, a companion 0-day disclosed by the same research team on the same date, hitting the exec_globals parameter on the same endpoint via a different CWE class (untrusted-sphere inclusion), and has been KEV-listed since July (Zero Day Initiative, ZDI-26-036). VulnCheck's honeypots (via Caitlin Condon) recorded at least 50 exploitation attempts against CVE-2026-0768 over one weekend, primarily from Russian source traffic, rising to 360 total attacks as of BleepingComputer's reporting, with no known public proof-of-concept (BleepingComputer, 2026-09-01). Post-exploitation requests query environment variables LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, read /root/.cache/langflow/secret_key, and check .ssh access and .bash_history size, a hunt signature that generalises to Langflow-adjacent exploitation regardless of which specific CVE is chased (BleepingComputer, 2026-09-01). heise's follow-up the next day independently confirms sustained, rising attack volume (heise Security, 2026-09-02). The current Langflow release is 1.12.0 (heise Security, 2026-09-02), which superseded 1.11.6 (the version BleepingComputer's 2026-09-01 report names as current) released later the same day per Langflow's own GitHub release history (Langflow GitHub Releases); the underlying fix for CVE-2026-0768 applies to any version after the affected 1.4.2 baseline, so 1.12.0 is simply the latest of many fixed releases rather than where the fix was newly introduced.

Triage: requests to the validate endpoint's code parameter that immediately follow with reads of /root/.cache/langflow/secret_key or environment-variable enumeration are the observable exploitation-and-harvest sequence; a legitimate custom-component workflow does not chain those two actions together.