What Changed
Attackers are exploiting CVE-2026-0768, a critical unauthenticated remote code execution flaw in Langflow, the open-source tool for building AI agents and workflows. The bug is in the code parameter of the validate endpoint, runs code as root, and affects Langflow 1.4.2 and earlier. It was disclosed in January.
VulnCheck saw at least 50 exploitation attempts against its UK honeypots over the weekend, mostly from Russia, later rising to 360. No public proof-of-concept exists.
What Attackers Want
According to VulnCheck’s Caitlin Condon, the attackers query environment variables and files that hold secrets: LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, and the Langflow secret key at /root/.cache/langflow/secret_key. The goal is cloud and AI credentials, not just the server.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
AI workflow tools are often deployed quickly by data and engineering teams, outside the usual hardening process, with broad API keys in their environment. Langflow has a long run of serious flaws, including CVE-2026-33017, CVE-2026-5027, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198.
What To Verify First
- Find every Langflow instance, including test and team-run deployments, and upgrade to 1.11.6.
- Take internet-exposed instances offline or put them behind authentication.
- Rotate OpenAI, AWS and other keys present on any instance running 1.4.2 or earlier.
- Review cloud and AI provider logs for use of those keys from unfamiliar locations.
What Teams May Be Underestimating
A flaw disclosed in January is still being exploited in September, so unpatched instances are clearly common. Stolen keys stay valid after the server is fixed until they are rotated, and cloud bills or data access can be the first sign they were used.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
