Cybercriminals are hijacking Langflow servers for cloud keys

A critical vulnerability in Langflow - a widely used open-source tool for building AI applications - lets anyone on the internet take full control of the server it runs on. No password needed.

Tracked as CVE-2026-0768, the vulnerability scores 9.8 out of 10 (Critical) on the CVSS severity scale. Security firm VulnCheck confirmed cybercriminals began exploiting it on August 29, 2026, to steal cloud and AI service credentials.

What is the Langflow vulnerability?

Langflow lets developers build AI workflows on a drag-and-drop canvas, including their own Python code. It offers to check that the code is valid, and the only way to do that is to run it. The check sits behind a web address, the "validate" endpoint, that accepts requests from anyone with no login. Compounding the problem, Langflow never inspects what the submitted code does before running it.

The vulnerability looks like this: A cybercriminal sends Python instructions of their choosing, and Langflow runs them as root, the 'administrator' account. Trend Micro's Zero Day Initiative reported the vulnerability in July 2025 and published advisory ZDI-26-034 on January 9, 2026.

Why this is dangerous

Root access means the intruder owns the server. What they do with it is quieter than ransomware, making it harder to spot. VulnCheck's decoy systems in the UK logged more than 50 attempts within hours on August 30, reaching over 360 by September 1. The traffic came from roughly 20 addresses in six countries, mostly Russia.

They're hunting for confidential tools: Langflow's own signing key and administrator credentials, Amazon Web Services secrets, OpenAI keys, SSH keys and configuration files. Those keys are the real prize, as they open the victim's cloud and AI billing accounts, allowing a cybercriminal to read company data or run up costs long after the intrusion. Nothing crashes and no files are locked, so a server compromise goes unnoticed.

Affected software

 Zero Day Initiative lists every Langflow release up to and including version 1.4.2 as vulnerable. Self-hosted installations reachable from the internet are the ones at risk.

Mitigation and next steps

Langflow has not published an advisory naming CVE-2026-0768, and neither Zero Day Initiative nor NVD lists a fixed version. What Langflow did ship is a hardening of custom-component code validation, released on September 1, 2026 in version 1.11.6 and version 1.12.0 the same day.

Run 1.12.0 or later. This version carries the same fix plus an optional sandbox that confines code-execution components, so injected code stays contained even if it runs. Because the vendor has not confirmed the CVE is closed, treat the upgrade as necessary but unverified and restrict who can reach the product, as Zero Day Initiative advises. Users should also take the Langflow interface off the public internet and put it behind a VPN or a login-protected proxy.

If you've run an exposed instance, assume compromise and replace:

• Langflow administrator key
• Cloud credentials
• AI service keys
• SSH keys

CISA hadn't added CVE-2026-0768 to its Known Exploited Vulnerabilities catalog as of September 1, 2026, so no federal patching deadline applies yet. Five other Langflow vulnerabilities are already on that list, and continued exploitation makes an addition likely.

Need help? 

If you have any questions, don't hesitate to reach out.

FAQ

1. Is CVE-2026-0768 being actively exploited? 
   

   Yes. Exploitation began on August 29, 2026, and decoy systems logged 360 attempts by September 1, coming from roughly 20 addresses in six countries. 
   
   

2. Which Langflow versions are affected?

   Zero Day Initiative confirmed every release up to and including version 1.4.2. No source states where the vulnerability was fixed, so upgrade to 1.12.0 or later, the newest release carrying Langflow's code-validation hardening.
   
   

3. Does patching remove the risk?

   No. If an exposed instance ran a vulnerable version, assume the credentials on it were stolen and replace them. Patching stops new intrusions but does not revoke keys already taken.