Attackers exploit critical Langflow flaw to harvest OpenAI and AWS credentials from AI app builders

Threat actors are actively exploiting a critical remote code execution vulnerability in Langflow, an open-source, Python-based platform used to build AI applications, agents, and RAG systems, to systematically harvest OpenAI API keys, AWS credentials, and administrative secrets from vulnerable instances. Threat intelligence firm VulnCheck said the attack volume it has tracked jumped from 50 exploitation attempts over a single weekend to 360 as of this week, with traffic concentrated from Russia-based sources.

The flaw, tracked as CVE-2026-0768, sits in the code validator of Langflow's custom component editor and allows unauthenticated attackers to execute arbitrary Python code with root privileges. It was disclosed in January and affects Langflow versions 1.4.2 and earlier; a fix is available in version 1.11.6.

The attackers are hunting for AI infrastructure credentials specifically

What distinguishes this campaign from generic post-exploitation is its target list. According to VulnCheck lead researcher Caitlin Condon, attacker requests systematically query environment variables named LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*, read the contents of Langflow's local secret-key cache file, and check for SSH access and command history size. This is not opportunistic scanning — it's a playbook built specifically around what a Langflow deployment is likely to hold: API keys for the language models it orchestrates and cloud credentials for the infrastructure it runs on.

That distinction matters because Langflow instances, by design, sit in the middle of an organization's AI stack — connecting to model providers, databases, and internal APIs to build agent workflows. A single compromised instance can hand an attacker not just server access but the keys to everything that server was configured to talk to.

Part of a longer pattern for this specific tool

This is not Langflow's first brush with active exploitation in 2026. In March, attackers exploited a separate critical code-injection flaw (CVE-2026-33017) within roughly a day of disclosure to run Python scripts and harvest environment and database files. Subsequent campaigns exploited a path-traversal bug (CVE-2026-5027) to write arbitrary files to servers, an authentication-bypass flaw (CVE-2026-55255) to access other users' AI workflows and deliver second-stage implants, and another RCE (CVE-2026-0770) to extract cloud credentials and container metadata. CISA has separately warned about a further Langflow flaw, CVE-2026-9198, being exploited alongside vulnerabilities in N-central and Apache Tomcat.

The recurrence isn't necessarily a sign of unusually poor engineering — rapidly-built AI tooling across the industry has repeatedly shipped with underbaked input validation on the code-execution surfaces that make these platforms useful in the first place. But it does mean any organization running Langflow needs to treat version currency as an ongoing operational requirement, not a one-time setup step.

What to do if you're running Langflow

VulnCheck reports no public proof-of-concept exploit is circulating yet for CVE-2026-0768, which limits — for now — the pool of attackers capable of exploiting it to those with independent exploit-development capability. That window will close. Langflow deployments still on version 1.4.2 or earlier should upgrade to 1.11.6 immediately, which addresses this flaw along with the prior string of CVEs. Any instance exposed to the public internet without authentication in front of it should be treated as already compromised until proven otherwise, given how directly the observed attack traffic maps to credential harvesting rather than reconnaissance.