Critical CVE-2026-0768 Exploited in Langflow Attacks

Hackers are actively exploiting a critical vulnerability in Langflow, tracked as CVE-2026-0768, which allows unauthenticated remote code execution. The flaw affects all versions up to 1.4.2 of the AI-focused low-code platform Langflow, enabling attackers to execute arbitrary Python code with root privileges. Security researchers from VulnCheck reported over 350 attempted attacks, primarily targeting UK-based systems. The vulnerability was disclosed in January 2026, and a patch has been available since then, but many systems remain unpatched. Attackers are stealing admin credentials and conducting reconnaissance on environment variables. The current exploitation is confirmed to be ongoing, with significant activity observed in recent days. Organizations are urged to apply the available fixes immediately to mitigate risks.

Key Points: • CVE-2026-0768 allows unauthenticated remote code execution in Langflow. • Over 350 exploitation attempts have been reported, primarily targeting UK systems. • A patch has been available since January 2026, but many systems remain vulnerable.