Agentic AI,
Artificial Intelligence & Machine Learning,
Governance & Risk Management
Tool’s Access to Compute Resources, Keys and Credentials Make It a Repeat Target
The open-source framework Langflow, renowned for facilitating the development of artificial intelligence agents and workflows, has once again found itself under siege due to a surge of exploit attempts in the wild. This uptick in attacks was initially reported on a Saturday when cybersecurity firm VulnCheck raised an alarm about a vulnerability enabling remote-code execution without requiring prior authentication by the attacker.
Identified as a critical flaw in Langflow’s code validator within its custom component editor, this vulnerability, tracked as CVE-2026-0768, has received a CVSS score of 9.8. Caitlin Condon, vice president of security research at VulnCheck, indicated that, until now, no evidence of proof-of-concept exploits had circulated in the wild. Following the initial attempts to exploit this flaw, VulnCheck’s monitoring system recorded the first wave of attacks.
According to Condon, attackers seemed to be engaging in reconnaissance and credential harvesting activities. They were probing the system by checking environment variables such as LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, and AWS_SECRET*. They were also attempting to read critical files like /root/.cache/langflow/secret_key, while checking for .ssh access and assessing the size of .bash_history.
The activity aiming to exploit this vulnerability is still ongoing. VulnCheck’s detection systems indicated that the number of observed attack attempts ballooned from 100 on the initial weekend to 360 by the following Monday. Analysis of source traffic identified a significant portion originating from Russia, with all activity focusing on canaries situated in the United Kingdom.
This framework is owned by IBM, which acquired Langflow during its 2025 takeover of DataStax, subsequently integrating the technology into its watsonx.ai platform for AI development. Hosted on GitHub, Langflow is notably popular within the development community, garnering contributions from 409 contributors, achieving 10,000 forks, and amassing 154,000 stars from users favoriting the project.
Despite the widespread awareness of this critical vulnerability, neither the Langflow project release notes nor the accompanying security bulletins from IBM clarified whether a patch had been applied or delineated any mitigations. However, VulnCheck indicated that the flaw had been addressed in updated version 1.10.1, which was released on June 23. The vulnerability relied on an exec() function to execute malicious code—a function that was subsequently removed in the patch. The company is yet to receive an official comment from IBM or Langflow regarding the matter.
This current vulnerability was first identified in version 1.4.2 of the tool, as reported by Trend Micro researchers who disclosed the zero-day flaw in July 2025 through Trend’s Zero Day Initiative. Researchers concluded that the vulnerability was a result of inadequate user-supplied string validation before executing Python code within the application, giving an attacker the ability to run code with root privileges.
Valuable Target for Attackers
Langflow emerges as a prime target for attackers due to its inherent capabilities, which could facilitate access to compute resources, system keys, and other sensitive data. According to VulnCheck, “Langflow and similar AI projects typically provide access to high-value systems, making them particularly appealing targets for malicious actors.”
Unfortunately, despite the high risks associated with its vulnerabilities, outdated versions of Langflow continue to be widely used. Prior warnings had indicated that a threat actor known as Jadepuffer was targeting an authentication flaw in the framework, identified as CVE-2025-3248. This vulnerability allowed remote code execution without authentication, which was exploited to deploy ransomware targeting AI models and training databases.
In response to these recurrent attacks, cybersecurity firm Sysdig published various defensive recommendations for users of Langflow during the July security assessments. These included immediate upgrades to version 1.3.0 or later, restricting access to Docker interfaces to hinder privilege escalation attempts, and ensuring stringent permissions for directories containing AI data while implementing immutable backup strategies.
Concerns escalated partly due to the timing of these vulnerabilities, as Langflow had released version 1.3.0 in April 2025. This left users susceptible to exploitation more than a year later for those who had yet to make necessary updates. Furthermore, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had initially warned on May 5, 2025, about ongoing exploitation of the vulnerability, which saw Trend Micro reporting attacks leveraging the flaw to deploy Flodrix botnet malware by June 2025.
VulnCheck elaborated that its comprehensive list includes an additional ten previously identified vulnerabilities within Langflow, with three of these newly discovered flaws being aggressively targeted in over 15,000 attacks this year alone. Once again, the greatest number of vulnerable Langflow instances were spotted in the United States, followed by other countries such as Germany, Malaysia, Brazil, India, France, Singapore, Canada, and the United Kingdom.
One of the ongoing challenges faced by Langflow users lies in the framework’s default configuration, which allows for public access. This openness can inadvertently increase the chances of exposure to the internet. “The first deployment model of Langflow is engineered for publicly accessible services,” VulnCheck noted. Although Langflow does advocate for security best practices, many new users may overlook these essential guidelines during setup.