← Back to feed
2026-09-05 Malicious ToolLLMjacking TLP:CLEAR

CVE-2026-0768: Langflow Critical RCE Under Active Exploitation for Credential Harvesting

Date: 2026-09-05
Tags: malicious-tool, llmjacking

Executive Summary

CVE-2026-0768, a critical CVSS 9.8 vulnerability published as a 0-day advisory by ZDI on January 9, 2026, resides in the validate endpoint of Langflow's custom component editor, allowing unauthenticated remote code execution by passing a user-supplied code parameter to Python's exec() function without sanitization. As of September 1, 2026, VulnCheck confirms active exploitation of this vulnerability. Attackers are systematically targeting Langflow to harvest credentials, with observed attacker behavior characterized by quiet, persistent credential extraction, querying environment variables and targeting sensitive files, including /root/.cache/langflow/secret_key.

Campaign Summary

FieldDetail
Campaign / MalwareLangflow Credential Harvesting Campaign
AttributionUnknown, Russia-attributed traffic observed (confidence: low)
TargetOrganizations running internet-exposed Langflow instances for AI application development
VectorUnauthenticated RCE via /validate endpoint in custom component editor
Statusactive
First Observed2026-09-01

Detailed Findings

The flaw allows unauthenticated remote code execution by passing a user-supplied code parameter to Python's exec() function without sanitization, with the exposure significantly compounded by Langflow's default auto-login feature, which frequently leaves these instances accessible to the public internet without any authentication requirement. Attackers appear to be carrying out reconnaissance and stealing credentials, checking environment variables such as Langflow, OpenAI and AWS keys, reading Langflow's secret key, and looking for SSH access and shell history. Observed commands attempted to retrieve environment variables associated with Langflow administration, OpenAI APIs, and AWS cloud access, with these checks helping an intruder identify administrator activity, stolen credentials, cloud resources, and possible routes for lateral movement. Threat actors have exploited as many as 12 Langflow vulnerabilities since 2025, with more than 15,000 successful attempts leveraging CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027, with the majority of the vulnerable Langflow hosts located in the U.S., Germany, Malaysia, Brazil, and India.

MITRE ATT&CK Mapping

TechniqueIDContext
Remote Code ExecutionT1190Unauthenticated exec() injection via /validate endpoint achieves RCE
Credential DumpingT1003Harvesting environment variables, AWS keys, OpenAI API keys, and SSH credentials

IOCs

Domains

_No specific payloads or C2 IOCs published; exploitation is generic credential enumeration_

Full URL Paths

_No specific payloads or C2 IOCs published; exploitation is generic credential enumeration_

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Langflow cloud deployments
Self-hosted Langflow instances

Detection Recommendations

Immediately identify and inventory all internet-exposed Langflow instances; apply vendor patches or mitigations urgently; rotate any exposed OpenAI and AWS credentials; review environment variables and local secret files (/root/.cache/langflow/secret_key) for signs of unauthorized access; implement network-level access controls restricting Langflow instances to trusted networks only. Monitor for POST requests to /validate endpoints with code parameters containing suspicious Python imports or exec calls.

References