Twelve Exploited CVEs in One Year: Why Attackers Keep Coming Back to Langflow

Twelve Langflow vulnerabilities were exploited in the wild during 2026. In all prior years combined, there was one. Successful exploitation attempts across that set exceed 15,000.

A run like that points at what AI development infrastructure has become worth attacking.

The current flaw

CVE-2026-0768 is a CVSS 9.8 unauthenticated remote code execution flaw in Langflow's custom component editor, specifically the code validator. ZDI published it as a zero-day advisory on 9 January 2026. It affects Langflow 1.4.2 and earlier.

The mechanism is short: the validate endpoint takes a user-supplied code parameter and passes it to Python's exec() without sanitization. No authentication, and execution happens as root.

VulnCheck saw exploitation attempts on its UK honeypots hours before public disclosure. About 50 attempts over a weekend became 360 observed attacks, mostly from Russia. Separate analysis put the exposed population near 7,000 servers.

What gets taken

This is where the story stops being about one CVE. After root execution, the attacker runs reconnaissance and reads environment variables, according to VulnCheck's Caitlin Condon. The target list:

• OPENAI_API_KEY and Anthropic tokens
• AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, plus GCP and Azure credentials
• Langflow superuser authentication keys
• Database connection strings
• /root/.cache/langflow/secret_key
• .ssh access and .bash_history, for lateral movement

Nobody attacks Langflow for the flow diagrams. A server that runs your workflows also holds every credential those workflows need, usually as static values in environment variables.

That is an architectural property of the category. Any self-hosted platform that executes user-defined workflows and stores long-lived provider keys has the same shape. Langflow gets hit because it is popular and exposed.

The 2026 pattern

• CVE-2026-33017 (March): unauthenticated RCE in the public flow build endpoint, weaponized within about 20 hours, used to harvest OpenAI, Anthropic, and AWS credentials before pivoting to Monero mining. Added to CISA KEV on 25 March.
• CVE-2026-5027 (CVSS 8.8): path traversal and arbitrary file write through the files endpoint, escalatable to RCE, with exploitation observed.
• CVE-2026-55255: unauthorized access to workflows, data theft, second-stage malware.
• CVE-2026-0770: root-level command execution for credential extraction and malware deployment.
• CVE-2026-9198: CISA flagged it after public proof-of-concepts surfaced.

Two problems repeat across that list.

Incomplete patching. CVE-2025-3248, disclosed in April 2025, was a different RCE in the same validate endpoint, fixed in 1.3.0. CVE-2026-0768 is a later injection in the same area. JFrog found versions reported as patched for related CVEs still exploitable after fixes shipped. A version number has not been a reliable signal here.

A shorter window than your process assumes. Twenty hours from disclosure to weaponization in March. Exploitation attempts before public disclosure in the current case. A response plan built on days is already behind.

If you run Langflow

1. Find exposed instances. Exposure is the biggest risk factor, and many instances reach the internet by accident.
2. Set LANGFLOW_AUTO_LOGIN to false and enforce authentication at the network edge rather than relying on the app.
3. Restrict network access. Rarely does a Langflow instance need to be reachable from the open internet.
4. Rotate exposed credentials: OpenAI, Anthropic, AWS, GCP, Azure, database strings. Assume anything exposed was harvested. Rotation is the only remedy.
5. Check environment variables, local secret files, and .bash_history for signs of access and lateral movement.

The structural fix and its cost

Patching faster helps and will not close this. Twelve CVEs in a year, with a history of incomplete fixes, calls for a smaller blast radius.

Stop embedding static API keys in flows. Brokered, short-lived credentials through Vault or a cloud KMS shrink the value of a successful exploit. A stolen 15-minute token is an incident. A stolen long-lived OPENAI_API_KEY is a bill and a breach.

The stronger version of the argument holds up too: a server that executes your flows and stores your keys is a high-value target by construction, and the safest architecture has no hosted endpoint executing anything. That trade costs you one-click cloud runs. Whether it pays depends on what the convenience buys your team.

Treating AI tooling as outside vulnerability management stopped being defensible. Twelve exploited CVEs in twelve months puts Langflow-class infrastructure in the same tier as any internet-facing application server, with the same patching cadence, exposure monitoring, and credential hygiene.

The full write-up, with the exploitation timeline and sources: https://www.hamvero.space/blog/langflow-twelfth-exploited-cve/