Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability in Langflow, a popular open-source framework for building AI applications, to pilfer cloud credentials and API keys. The flaw, tracked as CVE-2026-0768, is being leveraged in the wild to harvest sensitive data including OpenAI API keys and AWS secrets, according to threat intelligence firm VulnCheck. This active exploitation campaign highlights the growing risk of AI development platforms becoming prime targets for credential theft and data exfiltration.

The cybersecurity community is on high alert following the discovery of an active exploitation campaign targeting a critical vulnerability in Langflow, an open-source low-code platform used for building AI applications. This sophisticated attack campaign, which has seen a significant spike in activity over the past week, is specifically designed to harvest cloud credentials, API keys, and other sensitive data from vulnerable servers. The attacks represent a concerning trend in the hacking community, where AI infrastructure is increasingly becoming a primary target for data breaches and credential harvesting operations.

According to threat intelligence company VulnCheck, the exploitation attempts were first detected on their honeypots in the United Kingdom, where they observed at least 50 exploitation attempts over a single weekend. The attack traffic originated primarily from Russia, and the activity has intensified dramatically since the initial detection. VulnCheck lead security researcher Caitlin Condon reported that the total number of observed attacks has increased to 360 as of the latest count, indicating a coordinated and aggressive campaign against vulnerable Langflow instances worldwide.

The vulnerability, designated as CVE-2026-0768, received a critical severity rating and resides in the code validator of Langflow's custom component editor. The flaw allows attackers to execute arbitrary code without authentication, and with root privileges, making it an extremely dangerous attack vector. The specific issue exists within the handling of the code parameter provided to the validate endpoint, resulting from the lack of proper validation of a user-supplied string before using it to execute Python code. This vulnerability affects Langflow versions 1.4.2 and earlier, leaving a significant number of installations exposed to potential exploitation.

The attack methodology employed by the threat actors is particularly concerning due to its sophistication and focus on data exfiltration. According to Condon, the attackers conduct reconnaissance and query environment variables to harvest administrative credentials or superuser authentication keys for Langflow instances, AWS secrets, and OpenAI API keys. The attacker requests are specifically querying environment variables including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, while also reading /root/.cache/langflow/secret_key and checking .ssh access and .bash_history size. This comprehensive approach to credential harvesting suggests a well-planned operation designed to maximize data extraction from compromised systems.

Langflow is an open-source, Python-based low-code platform that has gained significant popularity for building AI applications, agents, chatbots, and retrieval-augmented generation (RAG) systems. The platform allows users to create workflows in a graphical interface by connecting components for language models, prompts, databases, APIs, and other tools. This popularity has made it an attractive target for cybercriminals, as compromising a single Langflow instance can potentially provide access to multiple AI services and associated credentials. The platform's widespread adoption in enterprise environments amplifies the potential impact of successful exploitation, as attackers can gain access to sensitive AI workflows and the underlying infrastructure.

This is not the first time Langflow has been targeted by attackers this year, indicating a persistent and ongoing campaign against the platform. In March, attackers leveraged CVE-2026-33017, a critical code-injection flaw, within about a day of its disclosure, using it to execute Python scripts and harvest .ENV and database files. This was followed by attacks exploiting CVE-2026-5027 to write arbitrary files to vulnerable servers and CVE-2026-55255 to access other users' AI workflows, steal sensitive data, and deliver second-stage implants. The pattern of exploitation suggests that threat actors are closely monitoring Langflow security disclosures and rapidly developing exploits for newly announced vulnerabilities.

The attack campaign has also included exploitation of CVE-2026-0770 to execute commands with root privileges, with attackers attempting to deploy malware and extract cloud credentials, environment variables, and container metadata. More recently, CISA warned that CVE-2026-9198 was being exploited after multiple proof-of-concept exploits became publicly available. This series of attacks demonstrates the significant interest that threat actors have in Langflow as an attack surface, and the potential for substantial data breaches when these vulnerabilities are successfully exploited. The rapid succession of exploited vulnerabilities suggests that Langflow has become a primary target for cybercriminals seeking to compromise AI infrastructure.

Despite the severity of the situation, Condon notes that there are no known public proof-of-concept (PoC) exploits for CVE-2026-0768, making the current exploitation campaign particularly noteworthy. The absence of public PoCs suggests that the attackers may have developed their own exploit or obtained it through private channels, indicating a higher level of sophistication and resource investment. This development is particularly concerning for the cybersecurity community, as it demonstrates that threat actors are capable of developing and deploying exploits for critical vulnerabilities even without public proof-of-concept code.

Langflow users are strongly recommended to upgrade to the latest available version, 1.11.6, which addresses all known flaws in the popular tool. This upgrade is critical for protecting against not only CVE-2026-0768 but also the other vulnerabilities that have been exploited in recent months. Organizations using Langflow should also conduct thorough security audits to check for signs of compromise, including unauthorized access to environment variables, suspicious modifications to system files, and unexpected network traffic. Additionally, security teams should review their cloud credential management practices and consider rotating any credentials that may have been exposed during the exploitation window.

The exploitation of CVE-2026-0768 serves as a stark reminder of the evolving threat landscape in the AI development space. As organizations increasingly adopt AI-powered tools and platforms, they must also recognize the associated security risks and implement comprehensive security measures to protect their infrastructure. This includes regular vulnerability assessments, prompt patch management, and robust monitoring for suspicious activities. The fact that attackers are specifically targeting AI platforms to steal credentials and API keys underscores the value of these assets and the need for enhanced security measures to protect them.

In conclusion, the active exploitation of CVE-2026-0768 in Langflow represents a significant threat to organizations using this popular AI development platform. The sophisticated attack campaign, which has already resulted in the theft of OpenAI and AWS credentials, demonstrates the growing interest of cybercriminals in AI infrastructure. Organizations must take immediate action to patch their Langflow installations and review their security posture to prevent potential data breaches. The rapid succession of exploited vulnerabilities in Langflow this year highlights the importance of maintaining up-to-date software and implementing comprehensive security monitoring to detect and respond to potential threats. As the AI landscape continues to evolve, so too must our approach to securing these powerful and increasingly targeted platforms.