Critical Langflow RCE Flaw Exploited to Harvest Credentials

Threat actors are exploiting a critical unauthenticated remote code execution vulnerability (CVE-2026-0768) in Langflow, an open-source framework for AI applications, to steal sensitive credentials, including AWS and OpenAI keys. VulnCheck reported over 360 exploitation attempts, primarily from Russia, targeting environment variables and administrative credentials. The flaw, disclosed in January 2026, allows attackers to execute arbitrary code without authentication. This vulnerability is part of a series of critical issues affecting Langflow, with previous exploits occurring earlier in 2026. Users are urged to upgrade to secure versions immediately. The situation is evolving, with active exploitation confirmed as of today.

Key Points: • CVE-2026-0768 allows unauthenticated remote code execution in Langflow. • Over 360 exploitation attempts have been observed, mainly from Russia. • Users are advised to upgrade Langflow to secure versions immediately.