Langflow Flaw Exploited to Steal OpenAI and AWS Keys
Servers for developing AI applications have become vaults of valuable secrets, accessible through a single unprotected request. Attackers have begun exploiting the critical vulnerability CVE-2026-0768 in Langflow to extract OpenAI and AWS keys, administrator credentials, and other confidential information.
Attacks Spotted on Honeypots
The company VulnCheck detected real attacks on decoys in the United Kingdom. At first, the researchers logged more than 50 requests. By 1 September, the number of attempts had grown to 360, with most of the traffic originating from Russia.
What Langflow Is
Langflow is an open-source, Python-based platform where developers assemble AI agents, chatbots, and other applications in a graphical editor. Components connect language models with databases, external APIs, and tools. As a result, the server often stores access keys for cloud services and models.
An Unauthenticated Root RCE
CVE-2026-0768 received a score of 9.8 out of 10 on the CVSS 3.1 scale and affects the validation handler for custom components. Langflow passed the received string to the Python interpreter without reliable filtering. Exploitation requires neither an account nor administrator action, and the injected code runs with root superuser privileges.
What the Attackers Query
During the attacks, the adversaries query the environment variables LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS, and AWS_SECRET. In addition, the requests read Langflow’s internal secret key, check access to the SSH directory, and determine the size of the Bash command history. No public demonstration exploit has yet been found. However, the absence of published code does not hinder real-world exploitation.
Patching and Response Guidance
The problem was disclosed in January 2026, and Langflow versions 1.4.2 and earlier are considered vulnerable. Administrators are advised to move to the current release, 1.11.6, and to restrict network access to the platform. If suspicious requests are detected, they should revoke and replace their OpenAI, AWS, and Langflow keys, and also check SSH access and command history on the server.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
