# CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active Exploitation

> CVE-2026-0768 (CVSS 9.8) is an unauthenticated remote code execution flaw in Langflow's /api/v1/validate/code endpoint, caused by insufficient validation of a user-supplied 'code' string before it is handed to the Python interpreter, letting an unauthenticated attacker run arbitrary Python as root. VulnCheck canary telemetry recorded a jump from 50+ to 360+ exploitation attempts between 2026-08-30 and 2026-09-01, with attackers (primarily Russia-based network origin) performing reconnaissance and credential harvesting against environment variables, the Langflow secret_key file, SSH access, and bash history.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2270
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-langflow-cve-2026-0768-code-injection-rce-tl-2026-2270.webp?v=dd97aa93 (Threadlinqs threat intel: CVE-2026-0768 Langflow Code Injection RCE: Detection & IOCs (TL-2026-2270) — Critical severity, 13 IOCs, 9 detection rules.)
- **ID:** TL-2026-2270
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)
- **CVEs:** CVE-2026-0768

## Description

CVE-2026-0768 is a critical (CVSS 3.0 base score 9.8) code-injection vulnerability in Langflow, an open-source, Python-based low-code platform for building AI agent and LLM-orchestration workflows. The flaw lives in the code validator behind the platform's custom-component editor, exposed at the unauthenticated POST /api/v1/validate/code REST endpoint (implemented in src/backend/base/langflow/api/v1/validate.py in the Langflow codebase): a user-supplied 'code' string is passed to the Python interpreter for execution without adequate sanitization or sandboxing (CWE-94, Improper Control of Generation of Code). Because the endpoint requires no authentication and the Langflow process typically runs with root privileges in default and containerized deployments, a single crafted HTTP request is sufficient for an attacker to achieve full remote code execution as root. OSV.dev pins the affected release as Langflow 1.4.2 (git commit 4b580d15696334e4e9455cd12506732317d6a185); SecurityWeek and downstream vulnerability databases describe the affected range more broadly as all releases up to and including 1.4.2. Notably, this is not the first code-injection issue at this exact route: a related, prior flaw at the same /api/v1/validate/code endpoint (CVE-2025-3248, missing authentication) was fixed in Langflow 1.3.0 by binding a CurrentActiveUser dependency to the route; CVE-2026-0768 demonstrates that unauthenticated or insufficiently validated code execution remains reachable at this endpoint in later releases. No publicly confirmed patched release exists in the sources reviewed at the time of writing, and Trend Micro's Zero Day Initiative (ZDI) states that restricting network access to the product is the only reliable mitigation until a fix ships.

The vulnerability was originally reported to the Langflow maintainers via GitHub on 2025-07-18 by Trend Research analysts Peter Girnus, William Gamazo Sanchez, and Alfredo Oliveira. After a status inquiry (2025-09-11) and a request for patch details (2025-10-10) went unresolved, ZDI notified the vendor of its intent to publish as an unpatched zero-day (2025-12-10) and released the public advisory ZDI-26-034 (ZDI-CAN-27322) on 2026-01-09, with the CVE formally published in NVD/CVE.org on 2026-01-30.

Active, opportunistic exploitation was confirmed in the wild starting 2026-08-30, when VulnCheck's Canary honeypot network recorded more than 50 exploitation attempts within a few hours; by 2026-09-01 that count had grown to over 360 attempts against VulnCheck's UK-based canaries, with additional targeting confirmed against canaries in Singapore and Israel. Attacker traffic against the canaries originated primarily from Russia-based network sources. Post-exploitation behavior observed on compromised canaries was reconnaissance- and credential-harvesting-focused rather than immediately destructive: attackers queried environment variables including LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET* variants (targeting both the platform's own admin credential and any LLM-provider/cloud credentials configured for agent workflows), read the root-owned secret key at /root/.cache/langflow/secret_key, checked for accessible SSH keys, and inspected the size of .bash_history — consistent with automated triage to identify high-value hosts for follow-on credential theft before deploying further tooling. Notably, EPSS scored CVE-2026-0768 at only ~1.65-2% predicted exploitation probability at the time of these reviewed sources, a sharp underestimate of the observed real-world exploitation volume and a reminder that EPSS alone should not gate patch prioritization for AI-orchestration platforms holding high-value credentials. Vulnerable, internet-exposed Langflow hosts observed in this activity were concentrated in the United States, Germany, Malaysia, Brazil, and India.

CVE-2026-0768 is one entry in a rapidly growing family of Langflow RCE vulnerabilities disclosed and exploited through 2026 (including CVE-2025-3248, CVE-2026-0769, CVE-2026-0770, CVE-2026-5027, CVE-2026-9198, and CVE-2026-33017); VulnCheck notes that whereas only one Langflow vulnerability was known to be exploited in the wild before 2026, at least 11 additional Langflow vulnerabilities have been targeted by attackers during 2026, reflecting sustained adversary interest in self-hosted AI agent/orchestration platforms as a route to both host compromise and theft of the LLM-provider and cloud credentials such platforms routinely hold. The scale of this ecosystem-wide activity is documented independently across multiple reviewed sources: VentureBeat reported roughly 7,000 internet-exposed Langflow instances (concentrated in North America) under active attack via CVE-2026-5027 (path traversal) and related LangGraph (CVE-2025-67644, CVE-2026-28277) and LangChain-core (CVE-2026-34070, CVE-2025-68664) flaws as of 2026-06-19; CISA added a separate, actively-exploited Langflow RCE (CVE-2026-9198, patched in 1.10.1) to its KEV catalog on 2026-08-05 with a two-day federal remediation deadline, after recording 650+ exploitation attempts from 41 countries; and on 2026-08-28 VulnCheck published a dedicated report ('Same Target, Different Playbooks') showing two distinct attacker clusters had together exploited sibling CVEs CVE-2026-5027, CVE-2025-3248, and CVE-2026-0769 more than 15,000 times, deploying a Python credential harvester, the SimpleHelp remote-access tool, cron-based persistence, a Chisel SOCKS5 tunnel, and an XMR cryptominer, with auditd disabled for forensic evasion. Those specific malware/tooling details are attributed by VulnCheck to the sibling CVEs rather than to CVE-2026-0768 itself, but they establish the operational context and canary infrastructure into which the CVE-2026-0768 exploitation wave (2026-08-30 onward) fell. As of the sources reviewed, CVE-2026-0768 itself had not been confirmed as added to the CISA KEV catalog, distinguishing it from sibling Langflow CVEs (e.g., CVE-2026-9198) that CISA has already added under Binding Operational Directive requirements.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1082 System Information Discovery
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.003 Shell History
- T1552.004 Private Keys
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Post-Exploitation Credential Harvesting from Langflow Process (CVE-2026-0768) — SPL** (`TL-2026-2270-SPL-002`)

Detects child processes of the Langflow/uvicorn service reading the root-owned secret_key file, .bash_history, SSH key material, or enumerating LANGFLOW_SUPERUSER/OPENAI_API*/AWS_ACCESS*/AWS_SECRET* environment variables — the exact reconnaissance-and-credential-harvesting behavior VulnCheck canaries recorded after CVE-2026-0768 exploitation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1082, T1552, T1552.001, T1552.003, T1552.004
- **Data sources:** sysmon_for_linux, linux_auditd, edr_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint (sourcetype="sysmon:linux" OR sourcetype="linux:audit")
(ParentImage="*/langflow*" OR parent_process_name="*langflow*" OR parent_process_name="*uvicorn*")
(CommandLine="*secret_key*" OR CommandLine="*.bash_history*" OR CommandLine="*/.ssh/*" OR CommandLine="*LANGFLOW_SUPERUSER*" OR CommandLine="*OPENAI_API*" OR CommandLine="*AWS_ACCESS*" OR CommandLine="*AWS_SECRET*")
| stats count min(_time) as first_seen values(CommandLine) as commands by host, User, ParentImage, Image
| where count > 0
| sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessParentFileName has_any ("langflow", "uvicorn")
| where FileName in ("cat", "env", "printenv", "strings", "grep", "less", "head")
    or ProcessCommandLine has_any ("secret_key", ".bash_history", ".ssh/", "LANGFLOW_SUPERUSER", "OPENAI_API", "AWS_ACCESS", "AWS_SECRET")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| summarize EventCount = count(), Commands = make_set(ProcessCommandLine) by DeviceName, bin(Timestamp, 1h)
| where EventCount > 0
```

### Sigma

```yaml
title: Post-Exploitation Credential Harvesting from Langflow Process (CVE-2026-0768)
id: 9e2d3f4a-5c6b-4d7e-9a0b-2c3d4e5f6172
status: experimental
description: Detects child processes of the Langflow service accessing the root-owned secret_key file, bash_history, SSH keys, or enumerating cloud/LLM-provider credential environment variables — consistent with post-RCE recon observed by VulnCheck canaries.
references:
    - https://www.vulncheck.com/blog/pwning-the-ai-stack
    - https://nvd.nist.gov/vuln/detail/CVE-2026-0768
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/01
tags:
    - attack.discovery
    - attack.t1082
    - attack.credential-access
    - attack.t1552
    - attack.t1552.001
    - attack.t1552.003
    - attack.t1552.004
    - cve.2026.0768
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|contains:
            - 'langflow'
            - 'uvicorn'
    selection_targets:
        CommandLine|contains:
            - 'secret_key'
            - '.bash_history'
            - '.ssh/'
            - 'LANGFLOW_SUPERUSER'
            - 'OPENAI_API'
            - 'AWS_ACCESS'
            - 'AWS_SECRET'
    condition: selection_parent and selection_targets
falsepositives:
    - Authorized administrators, backup jobs, or configuration-management/monitoring agents reading these same paths and variables as part of normal operations
level: high
```

**Known false positives:**

- Authorized administrators, backup jobs, or monitoring/config-management agents reading secret_key, bash_history, or SSH key paths as part of normal operations
- Log-shipping, credential-rotation, or secrets-scanning automation that legitimately enumerates the same environment variables

**Tuning notes:** Baseline and allowlist known backup/monitoring/config-management service accounts that legitimately touch these paths; sharply raise confidence and route to immediate triage when this fires within 30 minutes of TL-2026-2270-SPL-001/KQL-001/SIG-001 on the same host, since that sequence matches the RCE-then-credential-harvest chain VulnCheck documented.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] [indicator] Unauthenticated Python Code Injection (CVE-2026-0768) — KQL (locked: unlock with TL Creds)
- Post-Exploitation Credential Harvesting from [indicator] Process (CVE-2026-0768) — KQL (locked: unlock with TL Creds)
- Anomalous Shell/Network Child Process Spawned by [indicator] Service Post-RCE (CVE-2026-0768) — KQL (locked: unlock with TL Creds)
- [indicator] [indicator] Unauthenticated Python Code Injection (CVE-2026-0768) — Sigma (locked: unlock with TL Creds)
- Post-Exploitation Credential Harvesting from [indicator] Process (CVE-2026-0768) — Sigma (locked: unlock with TL Creds)
- Anomalous Shell/Network Child Process Spawned by [indicator] Service Post-RCE (CVE-2026-0768) — Sigma (locked: unlock with TL Creds)
- [indicator] [indicator] Unauthenticated Python Code Injection (CVE-2026-0768) — SPL (locked: unlock with TL Creds)
- Anomalous Shell/Network Child Process Spawned by [indicator] Service Post-RCE (CVE-2026-0768) — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- File hash: `4b580d15696334e4e9455cd12506732317d6a185`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Start Exploiting Critical Langflow Vulnerability](https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/)
- [ZDI-26-034: Langflow validate Endpoint Code Injection Remote Code Execution Vulnerability](https://www.zerodayinitiative.com/advisories/ZDI-26-034/)
- [NVD - CVE-2026-0768 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-0768)
- [CVE-2026-0768: Langflow Code Injection RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-0768/)
- [OSV.dev - CVE-2026-0768](https://osv.dev/vulnerability/CVE-2026-0768)
- [CVE Record - CVE-2026-0768](https://www.cve.org/CVERecord?id=CVE-2026-0768)
- [Attackers Exploit Critical Langflow and Rails Flaws in Credential-Harvesting Campaign](https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html)
- [7,000 Langflow servers are under attack. LangGraph and LangChain have the same holes](https://venturebeat.com/security/7000-langflow-servers-under-attack-langgraph-langchain-same-holes)
- [CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited](https://thehackernews.com/2026/08/cisa-flags-langflow-rce-tomcat-and-n.html)
- [Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack](https://www.vulncheck.com/blog/pwning-the-ai-stack)
- [GHSA-c995-4fw3-j39m: Langflow Vulnerable to Code Injection via the /api/v1/validate/code endpoint](https://github.com/advisories/GHSA-c995-4fw3-j39m)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2270