Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, the popular open-source framework used to build AI pipelines and agent workflows. The flaw allows attackers to execute arbitrary commands on a Langflow server without any credentials, and active exploitation campaigns are using it to steal API keys and tokens from the host environment — including OpenAI API keys and AWS credentials that can rack up large cloud bills or enable further compromise. Langflow installations are often deployed internally for AI application development, so the stolen keys frequently belong to development or production AI workloads.
Langflow had a different critical RCE bug — CVE-2026-33017 — added to CISA’s Known Exploited Vulnerabilities catalog earlier this year. CVE-2026-0768 is a separate flaw in the same platform, and active exploitation has been confirmed by multiple researchers. Developers who build AI applications with Langflow and expose the service to any network should treat this as an emergency patching priority: stolen API keys can result in unauthorized cloud spending in the tens of thousands of dollars within hours.
How to check if you’re affected
Affected versions of Langflow are those running before the patched release that addresses CVE-2026-0768. Check your Langflow instance version against the vendor’s advisory and apply the patch immediately. If you run Langflow on a server accessible from the internet or a shared network, review your API key usage dashboards for OpenAI, AWS, and any other integrated services for unexpected spikes or calls from unfamiliar IP addresses. Rotate any API keys stored in environment variables on the Langflow host, and audit .env files and secrets managers accessible from that server.