Attackers Exploit Critical Langflow RCE Flaw

Security researchers and incident response teams have observed active exploitation of a critical remote code execution vulnerability in the AI low-code platform Langflow, tracked as CVE-2026-0768. The flaw, rated CVSS 9.8, is in the code validator for Langflow’s custom component editor. A user-supplied string can be executed as Python without validation, allowing unauthenticated attackers to run arbitrary code as root. Langflow releases up to version 1.4.2 are affected. The issue was reported to the Zero Day Initiative in July 2025 and publicly disclosed in January 2026.

Vulnerability intelligence firm VulnCheck reported that attackers have used the flaw for reconnaissance and credential harvesting. The firm observed automated queries aimed at extracting environment variables, secret keys and SSH credentials. By Monday, VulnCheck recorded more than 360 exploitation attempts against its canaries in the United Kingdom, with many probing requests originating from IP addresses traced to Russia.

Telemetry shows attackers running commands to list environment variables and search files for keys and passwords, actions consistent with initial access and follow-on credential theft rather than immediate destructive activity. Security teams monitoring Langflow instances have been urged to review logs for suspicious command execution and other signs of compromise.

VulnCheck noted an increase in targeting of Langflow this year. The company reported that prior to 2026 only one Langflow vulnerability was known to be exploited in the wild, and that investigators have seen 11 additional vulnerabilities targeted in 2026. VulnCheck also reported more than 15,000 successful attacks against Langflow instances vulnerable to three previously observed flaws: CVE-2026-0769, CVE-2025-3248 and CVE-2026-5027.

Administrators running affected Langflow versions should apply vendor patches where available, isolate exposed instances from the public internet and rotate any credentials that may have been exposed. Teams unable to patch immediately are advised to block access to the custom component editor endpoints and enforce network-level controls until fixes are applied.

“Before 2026, evidence showed only one Langflow vulnerability known to be exploited in the wild. In 2026, things have changed fast. We’ve now seen 11 additional vulnerabilities targeted and reported as exploited in the wild,” VulnCheck reported.