Critical Langflow bug exploited to steal OpenAI and AWS secrets
Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability in Langflow, tracked as CVE-2026-0768, to harvest OpenAI and AWS credentials. The attacks, detected by VulnCheck, have targeted at least 360 instances, with traffic originating mainly from Russia. The flaw allows attackers to query environment variables and steal sensitive keys without authentication.
The campaign leverages CVE-2026-0768, a flaw in Langflow’s code validator that permits unauthenticated remote code execution with root privileges. VulnCheck observed over 360 attacks, primarily from Russian IPs, targeting honeypots and real instances. Attackers systematically probe environment variables for LANGFLOW_SUPERUSER, OpenAI API keys, and AWS credentials, while also reading secret key files and checking shell history. This marks the sixth known Langflow vulnerability exploited this year, following earlier flaws like CVE-2026-33017 and CVE-2026-9198, which were used for similar credential theft and malware deployment. The vendor’s latest release, 1.11.6, patches all disclosed issues, but many exposed instances remain unpatched.
This exploitation could have broad ripple effects for organizations relying on Langflow to build AI applications. Stolen OpenAI and AWS credentials may enable attackers to run costly models, access sensitive data, or pivot into cloud infrastructure, potentially leading to data breaches or financial losses. Smaller teams without dedicated security staff are especially vulnerable, as they may miss urgent patching advisories. While the immediate victims are Langflow users, the incident underscores how quickly AI development tools become targets, possibly eroding trust in open-source frameworks and prompting stricter access controls across the industry.