Langflow RCE Exploited in the Wild: Attackers Stripping OpenAI and AWS Keys from AI Servers

Langflow’s code validator just became the newest way to lose your cloud keys

An open-source RCE bug in Langflow sat unpatched for about seven months before anyone started hammering it. Now they are, hard. Threat actors are exploiting CVE-2026-0768, an unauthenticated remote code execution flaw in the custom component editor’s code validator, to walk onto AI workflow servers and help themselves to every credential nailed to the machine.

VulnCheck first spotted the activity over a weekend on its honeypots in the U.K., where the instances absorbed at least 50 exploitation attempts. Lead security researcher Caitlin Condon says the traffic kept building. By Monday, the total had climbed to 360 observed attacks, with most of it coming from Russian infrastructure.

What the attacker grabs

Once the validator runs their code, the attacker’s script goes looking for anything worth stealing. Condon’s write-up is specific about the shopping list: environment variables matching LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS* and AWS_SECRET*, the file at /root/.cache/langflow/secret_key, and even checks on .ssh access and .bash_history size.

Read that again and notice what it isn’t. There’s no ransom note, no web shell defacement, no noisy payload. The attacker wants your API keys and cloud secrets. An OpenAI key lets someone burn your billing quota for months before the invoice tells you. AWS credentials are worse, since they unlock the workloads behind them. For a fintech or health company running AI agents on rented GPUs, this is a breach of your entire cloud estate through a tool most security teams didn’t know was in the building.

The bug, and why it took so long

Langflow is a low-code Python platform for wiring up agents, chatbots and retrieval-augmented generation pipelines. You connect components for LLMs, prompts, databases and APIs on a canvas, and it produces running workflows. The vulnerability lives in the validate endpoint, which takes a user-supplied string and executes it as Python without validating it first. No login required. The code runs with whatever privileges the Langflow process holds, often root.

The flaw was disclosed in January and affects Langflow 1.4.2 and earlier. There’s still no public proof-of-concept exploit, which sounds reassuring and isn’t. VulnCheck’s honeypot data proves weaponized code exists in attacker hands regardless of what GitHub publishes.

Fourth exploitation wave in eight months

The uncomfortable part of this story is the pattern. CVE-2026-0768 is at least the fourth Langflow vulnerability exploited this year. In March, attackers weaponized CVE-2026-33017, another critical code-injection flaw, within about a day of disclosure to run Python scripts and harvest .env and database files. Then came CVE-2026-5027, used to write arbitrary files, and CVE-2026-55255, which let attackers read other users’ AI workflows and drop second-stage implants. CVE-2026-0770 followed, again for root-level command execution and cloud credential theft. CISA has since added CVE-2026-9198 to its catalog of actively exploited bugs after public PoCs circulated.

An AI development framework going through five exploitation waves in one calendar year tells you where the targets moved. Attackers are hunting the plumbing of the AI boom, and low-code agent builders are plumbing with weak defaults, exposed admin editors, and root privileges.

What African enterprises should do now

• Upgrade immediately. Langflow 1.11.6 closes all known flaws in the platform. If your data science team deployed Langflow without telling IT, find it first. Shadow AI deployments are the exposed flank here.
• Rotate every secret that touched an affected host. Upgrading removes the door; it does nothing about keys already walked out. Assume AWS access keys, OpenAI API keys and Langflow superuser credentials on vulnerable instances are compromised.
• Get the editor off the public internet. None of these campaigns needed a phishing email. The validate endpoint was simply reachable. If an admin-facing component answers on 443 from 0.0.0.0/0, it’s an internet-facing vulnerability.
• Watch environment enumeration. Reads of /root/.cache, .ssh and .bash_history, and bursts of process spawns querying env vars are loud in EDR. Alert on them.

Network-layer defense for the AI stack

The Langflow campaigns keep working because attack surface keeps hiding. Dev teams spin up workflow servers the security budget never sees, and each one is a standing invitation. eHawu’s network-layer protection is built for exactly this gap: continuous discovery of every device and service on your African enterprise network, so an unpatched AI tool can’t sit unmanaged until someone’s cloud keys are gone. If you run agents in production, run them where you can see them.