Langflow RCE under active attack, dumping OpenAI and AWS keys
A CVSS 9.8 unauthenticated root RCE (CVE-2026-0768) — patch to 1.11.6 and rotate keys now. A Rails flaw rides the same wave; plus a dirt-cheap diffusion LLM.
Copy markdown
Unauthenticated root RCE, via the component editor
CVE-2026-0768 (CVSS 9.8) sits in Langflow's custom-component code validator: a user-supplied string is executed as Python, as root, with no login required. Every release up to 1.4.2 is exposed and 1.11.6 is the fixed build — upgrade before you touch anything else.
It's already live, and your keys are the target
Active exploitation started the weekend before Sept 1 — 50+ honeypot hits within hours, 360+ by Monday, mostly from Russia. The payloads grep the environment for OPENAI_API keys, AWS_ACCESS/SECRET, the Langflow secret_key, SSH keys and bash history. If an instance was ever internet-exposed, assume the secrets are gone and rotate them.
A Rails flaw is riding the same wave
The same campaign is hitting CVE-2026-66066 (CVSS 9.5) in Rails: unauthenticated attackers read arbitrary files via crafted image uploads — an Active Storage/libvips mismatch — leaking the master key, DB passwords and cloud creds. 7,100+ instances were exposed; patch 8.1.3.1 blocks the file read but not every deserialization gadget.
Elsewhere: Inception's Mercury 2.5 undercuts the field on price
Inception's diffusion model Mercury 2.5 Preview is live on OpenRouter at $0.04 in / $0.15 out per million tokens, with a 260K context and tool-calling — built for cheap, high-throughput automation like bulk extraction and routing. It's a preview with unverified benchmarks, so treat it as a low-cost workhorse, not a frontier swap.