---
id: 2026-09-langflow-cve-2026-0768-validate-code-rce-exploited
title: "Langflow CVE-2026-0768 — unauthenticated validate-endpoint code injection (CVSS 9.8) mass-exploited to steal OpenAI/AWS keys"
date_disclosed: 2026-01-09
last_updated: 2026-09-10
severity: critical
status: active
ecosystems: [langflow, pypi, python, ai-agent-framework]
tools_affected: [langflow, any-internet-exposed-langflow-instance, openai-api-keys, aws-credentials]
tags: [cve, rce, code-injection, unauthenticated, langflow, exploited-in-the-wild, credential-theft, zero-day-disclosure, cwe-94]
---

## TL;DR

**CVE-2026-0768** is an unauthenticated remote code execution flaw in **Langflow**'s custom-component editor: the `validate` endpoint takes a user-supplied string and runs it as Python without checking it first, so an attacker who can reach the API executes code **as root** (CVSS **9.8**, CWE-94). Trend Research reported it to the vendor on **2025-07-18**; the Zero Day Initiative published it as a **0-day advisory on 2026-01-09** after notifying the vendor of intent to publish; NVD listed it 2026-01-23 against Langflow **1.4.2**. Nothing happened for seven months. Then on **2026-08-30** VulnCheck's canaries logged **50+ exploitation attempts within hours, rising to 360** by 2026-09-01 — with post-exploitation commands that read `LANGFLOW_SUPERUSER`, `OPENAI_API*`, `AWS_ACCESS*`/`AWS_SECRET*`, the Langflow secret-key file, `.ssh`, and `.bash_history`. This is, per The Hacker News' count, Langflow's **twelfth exploited CVE since 2025**. If Langflow is reachable from the internet, assume every key in its environment is gone.

## What happened

ZDI's advisory (ZDI-26-034, credited to Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira of Trend Research) describes the bug plainly: the `code` parameter handed to the validate endpoint is executed as Python with no validation of the string, and no authentication is required. The timeline on ZDI's page — reported 2025-07-18, vendor notified of intent to publish as a 0-day on 2025-12-10, published 2026-01-09 — is the coordinated-disclosure clock running out with no fix recorded on the advisory. NVD's record, published 2026-01-23, carries the 9.8 score and lists 1.4.2 as the affected version. Neither source states a fixed version, and this sweep did not find a vendor advisory naming one; see "Am I affected?" for how to reason about that.

Exploitation, when it came, was fast and credential-focused. VulnCheck (reported by The Hacker News on 2026-09-01 and Security Affairs on 2026-09-02) saw the first wave on **2026-08-30**: more than 50 detections in a few hours, 360 by the following Monday, most traffic from Russia, with UK-based systems among the targets. The attackers' first moves after code execution were reconnaissance for credentials, not persistence: environment variables for the Langflow superuser account and for OpenAI and AWS, `/root/.cache/langflow/secret_key`, SSH access, and the size of `.bash_history`. Subsequent payloads included credential harvesters, proxy agents, SimpleHelp remote-access software, and XMR miners. The same campaign hit Ruby on Rails' Active Storage (CVE-2026-66066, "KindaRails2Shell") for `secret_key_base`, master keys, and database and cloud-storage credentials — the attacker is collecting keys, and AI frameworks are where the most expensive keys live.

**How this relates to the Langflow CVEs already tracked here.** Langflow's validate endpoint has been a repeat offender: [CVE-2025-3248](2026-07-jadepuffer-langflow-agentic-ransomware.md) was the 2025 validate-endpoint RCE that JadePuffer and the [Hermes-agent scanning campaign](2026-08-knaithe-hermes-autonomous-ai-scanning.md) exploited, and [CVE-2026-33017](2026-03-langflow-rce.md), [CVE-2026-55255](2026-07-langflow-cve-2026-55255-idor-kev.md), and [CVE-2026-9198](2026-08-langflow-cve-2026-9198-autologin-bypass-rce.md) each got their own file. CVE-2026-0768 is a **distinct CVE with its own ZDI case**; ZDI's advisory does not describe it as a bypass of an earlier fix, so this repo does not either. What is shared is the lesson every prior Langflow entry ends on: **the authentication gate is the only thing that has reliably stopped these.**

## Am I affected?

You are exposed if you run Langflow **1.4.2 or earlier** anywhere an attacker can reach the API. Because neither ZDI nor NVD names a fixed version, treat "later than 1.4.2" as *probably* fixed and confirm against the vendor's current release notes — this repo's [CVE-2026-33017 entry](2026-03-langflow-rce.md) is the precedent for a Langflow "fix" that needed a second release.

```bash
pip show langflow 2>/dev/null | grep -i version
docker ps --format '{{.Image}}' | grep -i langflow
# Is the API reachable off-box?
ss -tlnp | grep -i '7860\|langflow'
# Post-exploitation signals reported by VulnCheck — check your instance's shell history and process list
grep -E 'OPENAI_API|AWS_(ACCESS|SECRET)|LANGFLOW_SUPERUSER|secret_key' /root/.bash_history 2>/dev/null
ls -la /root/.cache/langflow/secret_key 2>/dev/null
ps aux | grep -iE 'simplehelp|xmrig|minerd' | grep -v grep
```

If Langflow was internet-reachable on 2026-08-30 or later with `auto_login` on or no auth in front of it, assume compromise regardless of what the logs show — the reconnaissance commands are one-shot reads.

## If you are affected

1. Take the instance off the network. Upgrade to the current Langflow release **and** put authentication in front of it — the [Unit 42 agentic-scanning case](2026-08-knaithe-hermes-autonomous-ai-scanning.md) documented an autonomous attacker holding a working Langflow exploit that **failed because auth was on**.
2. Rotate everything the process could read: [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md) — OpenAI keys, AWS keys, the Langflow superuser password and secret key, and any SSH key on the host.
3. Treat the host as compromised, not just the app: [playbooks/if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md). The miners and remote-access tools are the *visible* payloads.

## Prevention

- [prevention/credential-hygiene.md](../prevention/credential-hygiene.md) — an AI framework's environment is a key ring. Short-lived, scoped credentials; nothing in `/root/.bash_history`.
- [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md) — an app whose feature is "run user-supplied Python" should not run as root, and should not be reachable from the internet without a login. Twelve exploited CVEs in one product is not a patch-cadence problem; it is a deployment-model problem.
- Subscribe to the KEV feed for the products in your stack. Langflow CVEs have gone from advisory to exploitation in **20 hours** ([CVE-2026-33017](2026-03-langflow-rce.md)) and, here, sat quietly for **seven months** before a mass campaign — the two cases argue for the same thing, which is not exposing the API at all.

## Sources

- [Zero Day Initiative — ZDI-26-034: (0Day) Langflow code Code Injection Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-034/) — fetched 2026-09-10; primary disclosure: CVE-2026-0768, CVSS 9.8 vector, mechanism, researcher credits, 2025-07-18 report / 2025-12-10 0-day notice / 2026-01-09 publication timeline.
- [NVD — CVE-2026-0768](https://nvd.nist.gov/vuln/detail/CVE-2026-0768) — fetched via the NVD API 2026-09-10; published 2026-01-23, CVSS 9.8, CWE-94, affected version 1.4.2, ZDI reference.
- [The Hacker News — Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html) — fetched 2026-09-10; published 2026-09-01: VulnCheck's 50+ → 360 detection figures from 2026-08-30, the exact environment variables and files targeted, payload types, the parallel Rails campaign, and the "12 exploited Langflow vulnerabilities" count.
- [Security Affairs — Hackers Target Langflow in CVE-2026-0768 Attacks](https://securityaffairs.com/198270/hacking/hackers-target-langflow-in-cve-2026-0768-attacks.html) — fetched 2026-09-10; published 2026-09-02: corroborating coverage of VulnCheck's canary detections (its own text dates first detection 2026-09-02 — The Hacker News' 2026-08-30 date is the earlier and is used here), affected range "up to 1.4.2," Russian-origin traffic, UK targets.
- [CSA Lab Space — CISO Daily Briefing, 2026-09-04](https://labs.cloudsecurityalliance.org/research/ciso-daily-briefing-20260904/) — fetched 2026-09-10; the roundup that surfaced this exploitation wave for the sweep; cites BleepingComputer and Security Affairs coverage.