Skip to content
Critical CVE-2026-0768 Exploited in Langflow Attacks

Critical CVE-2026-0768 Exploited in Langflow Attacks

First seen 2 Sep 2026, 10:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 3, 2026 at 10:28 UTC
  • •CVE-2026-0768 allows unauthenticated remote code execution in Langflow.
  • •Over 350 exploitation attempts have been reported, primarily targeting UK systems.
  • •A patch has been available since January 2026, but many systems remain vulnerable.

Hackers are actively exploiting a critical vulnerability in Langflow, tracked as CVE-2026-0768, which allows unauthenticated remote code execution. The flaw affects all versions up to 1.4.2 of the AI-focused low-code platform Langflow, enabling attackers to execute arbitrary Python code with root privileges. Security researchers from VulnCheck reported over 350 attempted attacks, primarily targeting UK-based systems. The vulnerability was disclosed in January 2026, and a patch has been available since then, but many systems remain unpatched. Attackers are stealing admin credentials and conducting reconnaissance on environment variables. The current exploitation is confirmed to be ongoing, with significant activity observed in recent days. Organizations are urged to apply the available fixes immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 45d ago How this analysis works

Timeline

2026-01-23
CVE-2026-0768 published
Langflow vulnerability disclosed, allowing remote code execution without authentication.
Securityaffairs.Co
2026-09-01
First public PoC released
Proof-of-concept code for CVE-2026-0768 became publicly available, increasing risk of exploitation.
Securityaffairs.Co
2026-09-02
Active exploitation confirmed
VulnCheck reports over 350 attacks targeting vulnerable Langflow instances, with ongoing exploitation observed.
Heise.De

More articles in this cluster (21)

Following this threat?

Track Langflow and CVE-2026-0768 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4