Vulnerability · Vendor Access

Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys

September 2, 2026 · 6 min read

On August 29, 2026, VulnCheck's honeypot infrastructure started lighting up with exploitation attempts against Langflow, an open-source, Python-based low-code platform for building AI agents and retrieval-augmented generation workflows. The vulnerability at the center of it all, CVE-2026-0768, carries a CVSS score of 9.8 and requires zero authentication to exploit. Attackers were sending crafted requests to Langflow's /validate endpoint and walking away with root-level code execution, then immediately pivoting to pull OpenAI API keys, AWS access credentials, SSH keys, and bash history off the compromised hosts. By the time the security community had written it up over that weekend, VulnCheck was reporting more than 15,000 successful exploitation events and 50-plus Canary detections in a single morning.

What actually happened

Langflow, now owned by IBM following its acquisition of DataStax in 2025, provides a visual interface for assembling AI pipelines. Part of that interface is a custom component editor that lets users write and validate Python code on the fly. The flaw, classified as CWE-94 (Code Injection), sits inside the code validator tied to this editor. The 'code' parameter passed to the /validate endpoint gets executed as Python without proper sanitization or sandbox controls. Anyone who can reach the endpoint over the network can supply arbitrary Python and have it run as root. There is no authentication gate, no privilege check, nothing. The CISA SSVCv2 assessment published alongside the NVD entry is blunt: automatable, total technical impact.

The vulnerability was originally reported through Trend Micro's Zero Day Initiative in July 2025 and publicly disclosed as ZDI-26-034 in January 2026. Active in-the-wild exploitation did not begin until August 29, 2026, shortly after CVE-2026-0768 was added to the VulnCheck Known Exploited Vulnerabilities catalog. Caitlin Condon, VP of Security Research at VulnCheck, announced the active exploitation via LinkedIn. Attack traffic originated primarily from Russia and, at the time of initial reporting, was directed at Canary systems located in the United Kingdom.

The post-exploitation pattern observed was methodical. Attackers targeted environment variables including LANGFLOW_SUPERUSER credentials, OPENAI_API keys, AWS_ACCESS and AWS_SECRET variables, along with the Langflow secret key stored at /root/.cache/langflow/secret_key. Beyond credential harvesting, researchers observed lateral movement attempts, SSH key access, database content exfiltration, and source code theft. Langflow deployments commonly hold live API keys for paid AI services precisely because they are the connective tissue between language models and backend infrastructure. That makes them a high-value target with a relatively contained blast radius to identify and exploit. All versions of Langflow up to and including 1.4.2 are confirmed affected. Attribution to a specific threat actor group remains unconfirmed at this time.

Why this should matter to you even if you don’t run Langflow

If you are not running Langflow, the pattern here still deserves attention. AI pipeline tooling is proliferating quickly across engineering teams, often deployed by developers who are focused on making the pipeline work and are less focused on the security posture of the tool itself. Langflow is representative of a broader class of low-code AI orchestration platforms, many of which expose HTTP APIs, execute user-supplied code, and store cloud provider credentials in environment variables on the same host. The attack surface is not theoretical.

The specific risk that CVE-2026-0768 illustrates is what happens when a tool designed to hold secrets (API keys, cloud credentials, service tokens) is also remotely exploitable at root level with no authentication required. Credential theft from AI orchestration layers can cascade quickly. A stolen OpenAI key runs up charges and exposes prompt history. A stolen AWS access key can pivot into S3 buckets, RDS instances, IAM roles, and beyond, depending on the permissions attached. The blast radius from a single compromised Langflow instance is not bounded by Langflow itself.

There is also a disclosure timing issue worth noting. The vulnerability was reported in July 2025, disclosed publicly in January 2026, and active exploitation did not appear until August 2026. That is a gap of roughly seven months between public disclosure and widespread active exploitation. Organizations running unpatched versions had time to act, but the exploitation data suggests many did not. VulnCheck reporting more than 15,000 successful attacks, along with 11 additional Langflow vulnerabilities being targeted and reported as exploited in the wild, suggests a broader pattern of under-maintained AI tooling deployments sitting exposed on the internet.

The control that would have blunted it

The control that would have had the most direct impact here is network-level access restriction on the Langflow service itself. The /validate endpoint carries no authentication requirement by design in affected versions, so the practical mitigation is preventing unauthenticated network access from reaching it in the first place. That means placing Langflow behind a VPN or zero-trust network access gateway, restricting ingress at the network perimeter to known IP ranges, and treating any internet-facing deployment of developer or AI pipeline tooling as a high-risk exposure that requires the same controls you would apply to an admin console.

Beyond network controls, the credential storage model matters. AI orchestration tools that need cloud provider keys and API tokens should be pulling those secrets from a secrets manager (AWS Secrets Manager, HashiCorp Vault, or equivalent) at runtime, rather than storing them as plaintext environment variables baked into the host or container environment. Plaintext environment variables are readable by any process running as the same user, and definitely readable by anything running as root. A secrets manager does not eliminate all risk, but it adds a meaningful layer: keys can be scoped, rotated, and audited independently of the host they are fetched from. If a host is compromised, you can revoke credentials without rebuilding every system that shared the same static key.

Cyber insurers increasingly ask about secrets management practices during underwriting, particularly for organizations running AI or cloud-connected workloads. The relevant controls they look for include short-lived credentials with automatic rotation, least-privilege IAM policies on cloud service accounts, and evidence of credential monitoring (detecting when a key is used from an unexpected location or at an unexpected volume). None of those controls would have prevented CVE-2026-0768 from being exploited, but they would have substantially reduced what an attacker could do with the credentials they extracted. That distinction matters both for limiting real-world damage and for demonstrating to insurers that your organization has a defensible posture around credential management in AI pipeline environments.

Patch cadence is the other operational reality to address directly. Seven months elapsed between public disclosure and widespread exploitation. In that window, patching to a fixed version (once available from the vendor) was the cleanest path. For teams running open-source AI tooling, the maintenance burden of tracking CVEs against every component in the AI stack is real, and it often falls on engineering teams without dedicated security resources. Building Langflow or similar tools into your software composition analysis pipeline, so new CVEs generate actionable alerts against your deployed version inventory, is the structural answer to that operational gap.

Strondex's Vendor Access Posture product helps engineering and security teams map credential exposure across AI pipeline tooling, assess network access controls on developer-facing services, and produce the evidence insurers ask for during underwriting and renewal.