Critical Langflow flaw exploited to steal your OpenAI and AWS keys
Unauthenticated root RCE (CVSS 9.8) in every Langflow up to 1.4.2. Exploitation is live — hundreds of attempts since the weekend. Patch to 1.11.6 and rotate.
Copy markdown
One unauthenticated request, root on your box
CVE-2026-0768 lets anyone hit Langflow's code-validator endpoint and run arbitrary Python as root — no login, no token. It's rated CVSS 9.8, about as bad as a flaw gets.
Am I exposed? Anything up to 1.4.2 is
Every Langflow release through 1.4.2 is vulnerable; the fix is 1.11.6. If you self-host the open-source app — most people do — upgrade now, and take the instance off the public internet until you have.
They're not after ransomware — they want your keys
The payloads read environment variables: LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*/SECRET*, plus the Langflow secret key, SSH keys, and bash history. Assume everything in that env has leaked and rotate all of it.
It's scaling fast, and there's no public PoC yet
VulnCheck honeypots jumped from ~50 hits to 360+ exploitation attempts within days, most traffic from Russia. No public proof-of-concept has dropped — meaning attackers are running private exploit code, so don't wait for one.
Do this today
Move to 1.11.6, rotate every credential that touched the Langflow environment, and grep your access logs for POSTs to the validate/custom-component routes. Langflow has a repeat history of RCE patch-bypasses, so keep it firewalled even after patching.