Langflow Under Attack: Unauthenticated Critical Flaw Steals OpenAI and AWS Keys

Since August 29, 2026, attackers have been actively exploiting a critical flaw in Langflow — a widely used open-source framework for building AI applications and agents — to steal OpenAI API keys and AWS credentials straight from exposed servers. The flaw carries a CVSS score of 9.8, the maximum severity rating, and requires zero credentials to exploit.

What CVE-2026-0768 actually is

The vulnerability lives in the code validator of Langflow's custom component editor. The endpoint that handles that validation, called "validate," accepts requests from anyone, no login required. Langflow never checks what the submitted code actually does before running it — it just executes it. The result is unauthenticated remote code execution (RCE): anyone who finds a Langflow instance exposed to the internet can run arbitrary commands on the server.

The flaw affects Langflow versions 1.4.2 and earlier. Although it was originally disclosed back in January 2026, security firm VulnCheck confirmed that mass active exploitation began on August 29, 2026, and the number of observed attacks has kept climbing since.

What attackers go after once they're in

Documented attack patterns show a very specific reconnaissance and credential-theft flow. Attackers query environment variables looking for LANGFLOW_SUPERUSER, along with OPENAI_API*, AWS_ACCESS*, and AWS_SECRET* patterns. They also read the /root/.cache/langflow/secret_key file and check for SSH key access and bash history size — classic reconnaissance signals ahead of lateral movement inside the compromised network.

What this means for companies building with Langflow or other agent frameworks

Langflow is popular precisely because it makes it easy to assemble AI pipelines through a visual interface — which is exactly why it shows up in proofs of concept, internal prototypes, and even production deployments built by teams without deep application-security experience. That same profile — easy to spin up, sometimes exposed to the internet without review — is what makes it an attractive target.

For any company running Langflow, the immediate priority is updating to a patched version and confirming that no instance is publicly exposed without authentication in front of it (a reverse proxy, VPN, or at minimum basic auth). Just as important: rotate any API key or cloud credential that was accessible as an environment variable on a Langflow server, even without direct evidence of compromise — the cost of rotating a key is far lower than the cost of a compromised cloud account.