CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation — Threadlinqs Intelligence
As of 2026-09-01, CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation is a critical-severity vulnerability threat attributed to unattributed opportunistic actor (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-2270 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: unattributed opportunistic actor · Russia · UNKNOWN
CVE-2026-0768 (CVSS 9.8) is an unauthenticated remote code execution flaw in Langflow's /api/v1/validate/code endpoint, caused by insufficient validation of a user-supplied 'code' string before it is
CVE-2026-0768 is a critical (CVSS 3.0 base score 9.8) code-injection vulnerability in Langflow, an open-source, Python-based low-code platform for building AI agent and LLM-orchestration workflows. The flaw lives in the code validator behind the platform's custom-component editor, exposed at the unauthenticated POST /api/v1/validate/code REST endpoint (implemented in src/backend/base/langflow/api/v1/validate.py in the Langflow codebase): a user-supplied 'code' string is passed to the Python interpreter for execution without adequate sanitization or sandboxing (CWE-94, Improper Control of Generation of Code). Because the endpoint requires no authentication and the Langflow process typically runs with root privileges in default and containerized deployments, a single crafted HTTP request is sufficient for an attacker to achieve full remote code execution as root. OSV.dev pins the affected release as Langflow 1.4.2 (git commit 4b580d15696334e4e9455cd12506732317d6a185); SecurityWeek and downstream vulnerability databases describe the affected range more broadly as all releases up to and including 1.4.2. Notably, this is not the first code-injection issue at this exact route: a related, prior flaw at the same /api/v1/validate/code endpoint (CVE-2025-3248, missing authentication) was fixed in Langflow 1.3.0 by binding a CurrentActiveUser dependency to the route; CVE-2026-0768 demonstrates that unauthenticated or insufficiently validated code execution remains reachable at this endpoint in later releases. No publicly confirmed patched release exists in the sources reviewed at the time of writing, and Trend Micro's Zero Day Initiative (ZDI) states that restricting network access to the product is the only reliable mitigation until a fix ships.
The vulnerability was originally reported to the Langflow maintainers via GitHub on 2025-07-18 by Trend Research analysts Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira. After a status inquiry (2025-09-11) and a request for patch details (2025-10-10) went unresolved, ZDI notified the vendor of its intent to publish as an unpatched zero-day (2025-12-10) and released the public advisory ZDI-26-034 (ZDI-CAN-27322) on 2026-01-09, with the CVE formally published in NVD/CVE.org on 2026-01-30.
Active, opportunistic exploitation was confirmed in the wild starting 2026-08-30, when VulnCheck's Canary honeypot network recorded more than 50 exploitation attempts within a few hours; by 2026-09-01 that count had grown to over 360 attempts against VulnCheck's UK-based canaries, with additional targeting confirmed against canaries in Singapore and Israel. Attacker traffic against the canaries originated primarily from Russia-based network sources. Post-exploitation behavior observed on compromised canaries was reconnaissance- and credential-harvesting-focused rather than immediately destructive: attackers queried environment variables including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET* variants (targeting both the platform's own admin credential and any LLM-provider/cloud credentials configured for agent workflows), read the root-owned secret key at /root/.cache/langflow/secret_key, checked for accessible SSH keys, and inspected the size of .bash_history — consistent with automated triage to identify high-value hosts for follow-on credential theft before deploying further tooling. Notably, EPSS scored CVE-2026-0768 at only ~1.65-2% predicted exploitation probability at the time of these reviewed sources, a sharp underestimate of the observed real-world exploitation volume and a reminder that EPSS alone should not gate patch prioritization for AI-orchestration platforms holding high-value credentials. Vulnerable, internet-exposed Langflow hosts observed in this activity were concentrated in the United States, Germany, Malaysia, Brazil, and India.
CVE-2026-0768 is one entry in a rapidly growing family of Langflow RCE vulnerabilities disclosed and exploited through 2026 (includin
Target regions: united states of america, germany, malaysia, brazil, india
Timeline
- Trend Research (Peter Girnus, William Gamazo Sanchez, Alfredo Oliveira) reports the validate-endpoint code injection flaw to Langflow maintainers via GitHub.
- Zero Day Initiative sends a status inquiry to the vendor after no response.
- ZDI requests patch details from the vendor.
- ZDI notifies the vendor of its intent to publish the advisory as an unpatched zero-day.
- ZDI publishes advisory ZDI-26-034 (ZDI-CAN-27322) disclosing CVE-2026-0768 as an unpatched zero-day.
- CVE-2026-0768 is formally published in NVD/CVE.org with CVSS 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- VentureBeat reports roughly 7,000 internet-exposed Langflow servers under active attack via sibling vulnerabilities (path traversal CVE-2026-5027, missing-auth CVE-2025-3248) alongside related LangGraph and LangChain-core flaws, establishing the broader Langflow/LangChain ecosystem exploitation trend that preceded CVE-2026-0768's own exploitation wave.
- CISA adds a separate, actively-exploited Langflow RCE (CVE-2026-9198, patched in Langflow 1.10.1) to its Known Exploited Vulnerabilities catalog after 650+ exploitation attempts from 41 countries, with a two-day federal remediation deadline; CVE-2026-0768 itself is not confirmed in KEV as of the sources reviewed.
- VulnCheck publishes 'Same Target, Different Playbooks,' documenting two distinct attacker clusters (a credential-theft operation deploying a Python harvester and SimpleHelp RAT, and a cryptomining operation using Chisel tunneling and an XMR miner) that together exploited sibling Langflow CVEs CVE-2026-5027, CVE-2025-3248, and CVE-2026-0769 more than 15,000 times via the same canary infrastructure that would soon detect CVE-2026-0768 exploitation.
- VulnCheck Canary honeypots record 50+ exploitation attempts against CVE-2026-0768 within a few hours.
- VulnCheck reports 360+ cumulative exploitation attempts against UK-based canaries (with additional targeting confirmed against Singapore and Israel); SecurityWeek and The Hacker News confirm active reconnaissance and credential-harvesting exploitation of CVE-2026-0768 in the wild, primarily from Russia-based network sources.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-0768, T1595.002, T1190, T1059.006, T1082, T1552, T1552.001, T1552.003, T1552.004, T1005
