---
schema: 1
kind: vulnerability
title: "CVE-2026-0768 — Langflow: a code-injection RCE patched since January sees renewed mass exploitation, harvesting AWS and OpenAI credentials from environment variables"
headline: "A months-old, already-patched Langflow RCE draws 360 attack attempts in days once honeypots start counting"
summary: >
  VulnCheck reports renewed active exploitation of CVE-2026-0768 (CVSS 9.8), an unauthenticated code-injection
  remote-code-execution flaw in Langflow's custom-component validate endpoint, disclosed by Trend Micro ZDI in
  January 2026 and long since patched. Honeypots recorded at least 50 exploitation attempts over one weekend, rising
  to 360, with post-exploitation requests harvesting AWS and OpenAI credentials from environment variables — a
  distinct CVE from the KEV-listed CVE-2026-0770, already covered since 2026-07-22, on the same validate endpoint.
discovered_at: "2026-09-03T05:20:00Z"
updated_at: null
event_date: "2026-08-30"
run_id: 2026-09-03T0410Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, actively-exploited, patch-available, ai-abuse]
regions: [global]
sectors: [technology, public-sector, education]
entities: []
techniques: [T1190, T1552.001]
affected_products: ["Langflow"]
cves:
  - id: CVE-2026-0768
    cvss: "9.8"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [exploited, patch-available]
    affected: "Langflow ≤ 1.4.2"
    fixed: "1.12.0 (current release; the fix itself applies to any version after 1.4.2)"
sources:
  - url: "https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/"
    publisher: "BleepingComputer"
    date: "2026-09-01"
    role: primary
  - url: "https://www.heise.de/news/Jetzt-patchen-Angreifer-attackieren-Langflow-Instanzen-mit-Schadcode-11437701.html"
    publisher: "heise Security"
    date: "2026-09-02"
    role: corroborating
  - url: "https://www.zerodayinitiative.com/advisories/ZDI-26-034/"
    publisher: "Zero Day Initiative (Trend Micro)"
    date: "2026-01-09"
    role: corroborating
  - url: "https://www.zerodayinitiative.com/advisories/ZDI-26-036/"
    publisher: "Zero Day Initiative (Trend Micro)"
    date: "2026-01-09"
    role: corroborating
  - url: "https://github.com/langflow-ai/langflow/releases"
    publisher: "Langflow (GitHub Releases)"
    date: "2026-09-01"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading /root/.cache/langflow/secret_key, and checking .ssh access and .bash_history size"
    publisher: "VulnCheck (Caitlin Condon), via BleepingComputer"
  - quote: "Die Sicherheitsforscher geben an, mittlerweile mehr als 350 Angriffsversuche beobachtet zu haben – Tendenz steigend."
    publisher: "heise Security"
verification: multi-source
sourcing_note: >
  VulnCheck's own commentary is published only on LinkedIn (single channel); BleepingComputer's independent
  write-up, naming the same researcher and figures directly, is treated as the second corroborating source per the
  two-source rule. CVE-2026-0768 (CWE-94, `code` parameter, ZDI-26-034, not KEV-listed) is confirmed distinct from
  CVE-2026-0770 (CWE-829, `exec_globals` parameter, KEV-listed 2026-07-21, already covered as a separate entry) —
  both disclosed by the same Trend Research team on the same coordinated release date, which is the likely source
  of confusion between the two, but
  they are separate ZDI cases with different CWE classes and different vulnerable parameters on the same endpoint.
confidence: medium
references:
  - 2026-07-22/langflow-cve-2026-0770-exploited-ncsc-nl-15-cve-batch
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every self-hosted Langflow instance to the current release (1.12.0) now if still running any version at or below 1.4.2; where AWS or OpenAI credentials were configured as environment variables on an exposed instance, rotate them and check for outbound API usage from unfamiliar sources."
updates: []
migrated_from: null
---

Langflow is a self-hosted AI-workflow/agent-building platform whose custom-component validate endpoint has now
produced several distinct remote-code-execution CVEs in 2026. CVE-2026-0768 (CVSS 9.8, CWE-94 code injection) sits
in the endpoint's handling of the `code` parameter: the flaw lacks proper validation of a user-supplied string
before using it to execute Python code, with no authentication required and execution running as root. Disclosed
by Trend Micro's Zero Day Initiative
([ZDI-26-034](https://www.zerodayinitiative.com/advisories/ZDI-26-034/)) in January 2026, it is a genuinely separate vulnerability from
CVE-2026-0770 — a companion 0-day disclosed by the same research team on the same date, hitting the `exec_globals`
parameter on the same endpoint via a different CWE class (untrusted-sphere inclusion), and has been
KEV-listed since July
([Zero Day Initiative, ZDI-26-036](https://www.zerodayinitiative.com/advisories/ZDI-26-036/)).
VulnCheck's honeypots (via Caitlin Condon) recorded at least 50 exploitation
attempts against CVE-2026-0768 over one weekend, primarily from Russian source traffic, rising to 360 total attacks
as of BleepingComputer's reporting, with no known public proof-of-concept
([BleepingComputer, 2026-09-01](https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/)).
Post-exploitation requests query environment variables `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*` and
`AWS_SECRET*`, read `/root/.cache/langflow/secret_key`, and check `.ssh` access and `.bash_history` size — a hunt
signature that generalises to Langflow-adjacent exploitation regardless of which specific CVE is chased
([BleepingComputer, 2026-09-01](https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/)).
heise's follow-up the next day independently confirms sustained, rising attack volume
([heise Security, 2026-09-02](https://www.heise.de/news/Jetzt-patchen-Angreifer-attackieren-Langflow-Instanzen-mit-Schadcode-11437701.html)).
The current Langflow release is 1.12.0
([heise Security, 2026-09-02](https://www.heise.de/news/Jetzt-patchen-Angreifer-attackieren-Langflow-Instanzen-mit-Schadcode-11437701.html)),
which superseded 1.11.6 — the version BleepingComputer's 2026-09-01 report names as current — released later the
same day per Langflow's own GitHub release history
([Langflow GitHub Releases](https://github.com/langflow-ai/langflow/releases));
the underlying fix for CVE-2026-0768 applies to any version after the
affected 1.4.2 baseline, so 1.12.0 is simply the latest of many fixed releases rather than where the fix was newly
introduced.

**Triage:** requests to the validate endpoint's `code` parameter that immediately follow with reads of
`/root/.cache/langflow/secret_key` or environment-variable enumeration are the observable exploitation-and-harvest
sequence — a legitimate custom-component workflow does not chain those two actions together. **Defender takeaway:**
any organisation self-hosting Langflow — increasingly public-sector and research bodies building internal
LLM/agent pipelines — should confirm the instance is on 1.12.0 or later, and treat any AWS or OpenAI credential
configured as an environment variable on an instance that was ever exposed at or below 1.4.2 as potentially
harvested, rotating it as a precaution rather than waiting for confirmed misuse.