CVE-2026-0768 is a critical (CVSS 3.0 base score 9.8) code-injection vulnerability in Langflow, an open-source, Python-based low-code platform for building AI agent and LLM-orchestration workflows. The flaw lives in the code validator behind the platform's custom-component editor, exposed at the unauthenticated POST /api/v1/validate/code REST endpoint (implemented in src/backend/base/langflow/api/v1/validate.py in the Langflow codebase): a user-supplied 'code' string is passed to the Python interpreter for execution without adequate sanitization or sandboxing (CWE-94, Improper Control of Generation of Code). Because the endpoint requires no authentication and the Langflow process typically runs with root privileges in default and containerized deployments, a single crafted HTTP request is sufficient for an attacker to achieve full remote code execution as root. OSV.dev pins the affected release as Langflow 1.4.2 (git commit 4b580d15696334e4e9455cd12506732317d6a185); SecurityWeek and downstream vulnerability databases describe the affected range more broadly as all releases up to and including 1.4.2. Notably, this is not the first code-injection issue at this exact route: a related, prior flaw at the same /api/v1/validate/code endpoint (CVE-2025-3248, missing authentication) was fixed in Langflow 1.3.0 by binding a CurrentActiveUser dependency to the route; CVE-2026-0768 demonstrates that unauthenticated or insufficiently validated code execution remains reachable at this endpoint in later releases. No publicly confirmed patched release exists in the sources reviewed at the time of writing, and Trend Micro's Zero Day Initiative (ZDI) states that restricting network access to the product is the only reliable mitigation until a fix ships.

The vulnerability was originally reported to the Langflow maintainers via GitHub on 2025-07-18 by Trend Research analysts Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira. After a status inquiry (2025-09-11) and a request for patch details (2025-10-10) went unresolved, ZDI notified the vendor of its intent to publish as an unpatched zero-day (2025-12-10) and released the public advisory ZDI-26-034 (ZDI-CAN-27322) on 2026-01-09, with the CVE formally published in NVD/CVE.org on 2026-01-30.

Active, opportunistic exploitation was confirmed in the wild starting 2026-08-30, when VulnCheck's Canary honeypot network recorded more than 50 exploitation attempts within a few hours; by 2026-09-01 that count had grown to over 360 attempts against VulnCheck's UK-based canaries, with additional targeting confirmed against canaries in Singapore and Israel. Attacker traffic against the canaries originated primarily from Russia-based network sources. Post-exploitation behavior observed on compromised canaries was reconnaissance- and credential-harvesting-focused rather than immediately destructive: attackers queried environment variables including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET* variants (targeting both the platform's own admin credential and any LLM-provider/cloud credentials configured for agent workflows), read the root-owned secret key at /root/.cache/langflow/secret_key, checked for accessible SSH keys, and inspected the size of .bash_history — consistent with automated triage to identify high-value hosts for follow-on credential theft before deploying further tooling. Notably, EPSS scored CVE-2026-0768 at only ~1.65-2% predicted exploitation probability at the time of these reviewed sources, a sharp underestimate of the observed real-world exploitation volume and a reminder that EPSS alone should not gate patch prioritization for AI-orchestration platforms holding high-value credentials. Vulnerable, internet-exposed Langflow hosts observed in this activity were concentrated in the United States, Germany, Malaysia, Brazil, and India.

CVE-2026-0768 is one entry in a rapidly growing family of Langflow RCE vulnerabilities disclosed and exploited through 2026 (including CVE-2025-3248, CVE-2026-0769, CVE-2026-0770, CVE-2026-5027, CVE-2026-9198, and CVE-2026-33017); VulnCheck notes that whereas only one Langflow vulnerability was known to be exploited in the wild before 2026, at least 11 additional Langflow vulnerabilities have been targeted by attackers during 2026, reflecting sustained adversary interest in self-hosted AI agent/orchestration platforms as a route to both host compromise and theft of the LLM-provider and cloud credentials such platforms routinely hold. The scale of this ecosystem-wide activity is documented independently across multiple reviewed sources: VentureBeat reported roughly 7,000 internet-exposed Langflow instances (concentrated in North America) under active attack via CVE-2026-5027 (path traversal) and related LangGraph (CVE-2025-67644, CVE-2026-28277) and LangChain-core (CVE-2026-34070, CVE-2025-68664) flaws as of 2026-06-19; CISA added a separate, actively-exploited Langflow RCE (CVE-2026-9198, patched in 1.10.1) to its KEV catalog on 2026-08-05 with a two-day federal remediation deadline, after recording 650+ exploitation attempts from 41 countries; and on 2026-08-28 VulnCheck published a dedicated report ('Same Target, Different Playbooks') showing two distinct attacker clusters had together exploited sibling CVEs CVE-2026-5027, CVE-2025-3248, and CVE-2026-0769 more than 15,000 times, deploying a Python credential harvester, the SimpleHelp remote-access tool, cron-based persistence, a Chisel SOCKS5 tunnel, and an XMR cryptominer, with auditd disabled for forensic evasion. Those specific malware/tooling details are attributed by VulnCheck to the sibling CVEs rather than to CVE-2026-0768 itself, but they establish the operational context and canary infrastructure into which the CVE-2026-0768 exploitation wave (2026-08-30 onward) fell. As of the sources reviewed, CVE-2026-0768 itself had not been confirmed as added to the CISA KEV catalog, distinguishing it from sibling Langflow CVEs (e.g., CVE-2026-9198) that CISA has already added under Binding Operational Directive requirements.