CVE-2026-0768 · Langflow Unauthenticated Remote Code Execution via validate_code…

01 · The Real Story

Someone left the car keys in the ignition, the engine running, and the doors unlocked — on the internet

CVE-2026-0768 is an unauthenticated remote code execution vulnerability in Langflow, an open-source AI agent and workflow builder. The flaw lives in the POST /api/v1/validate/code endpoint, which accepts arbitrary Python code via a JSON code field and passes it directly to Python's exec() without authentication or sanitization. Because Python evaluates decorator expressions and default-argument values at function-definition time — before the function is ever called — an attacker's payload executes the moment the server parses the submitted code. Exploitation yields a root-level shell. Affected versions: all Langflow releases through 1.4.2. As of October 2026, no confirmed vendor patch exists. This is the fourth Langflow CVE actively exploited this year alone.

The vendor's CRITICAL / 9.8 rating is, if anything, *generous to the vendor* by implying a normal patch cycle applies. This is an unauthenticated, zero-click, remotely exploitable bug that gives root, has multiple public weaponized tools (Metasploit module, Nuclei template, FlowHound exploitation framework, standalone PoC), is under active mass exploitation since late August 2026, and has no patch. Every friction knob in the CVSS vector is already at its worst-case setting. The 9.8 is accurate, and if you run Langflow internet-facing, you should be treating this as a confirmed breach until proven otherwise.

"Unauth RCE running as root with zero friction, active exploitation, and no vendor patch. This is a five-alarm fire."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Discover exposed Langflow instance

The attacker scans for Langflow's default port (7860) or identifies instances via Shodan, Censys, or FOFA. Censys currently indexes approximately 7,000 internet-facing Langflow instances, predominantly in North America. Shodan shows roughly 1,050. The /api/v1/version endpoint returns the running version unauthenticated, letting the attacker confirm exploitability before firing.

Conditions required:

Target Langflow instance is network-reachable (internet or internal)

Where this breaks in practice:

None — Langflow binds to 0.0.0.0 by default and the version endpoint is unauthenticated

Detection/coverage: Nuclei template CVE-2026-0768 (nuclei-templates v10.4.9). Qualys QIDs 735405 and 735263. Shodan/Censys queries for http.title:Langflow or port 7860.

STEP 02

Send malicious POST to /api/v1/validate/code

The attacker sends a single POST /api/v1/validate/code request with a JSON body containing a code field. The payload uses Python's decorator-evaluation or default-argument-evaluation trick: e.g., @exec("raise Exception(__import__('subprocess').check_output('id'))")\ndef _f(): pass. The endpoint requires no authentication. Observed evasion tactics include spoofed X-Forwarded-For: 127.0.0.1 headers and forged AI-crawler User-Agent strings (ChatGPT-User, ClaudeBot, PerplexityBot). Weaponized tools: Metasploit module exploit/multi/http/langflow_unauth_rce_cve_2026_0768 (by rmhowe425), Nuclei template, FlowHound automated exploitation framework, standalone PoC.

Conditions required:

HTTP(S) connectivity to the /api/v1/validate/code endpoint

Where this breaks in practice:

None — no auth, no CSRF, no rate limiting in default config

Detection/coverage: WAF rules matching exec(, subprocess, __import__ in POST body to /api/v1/validate/code. F5 Labs reports behavioral tags: Server Side Code Injection (405 events), Command Execution (329), Information Leakage (310).

STEP 03

Achieve root-level code execution

Python's exec() runs the attacker's code in the Langflow server process context. Langflow's default Docker and bare-metal install guides run the process as root. The attacker now has arbitrary OS command execution with root privileges. Observed payloads include reverse shells, subprocess.check_output() calls, and timing-based capability probes using time.sleep().

Conditions required:

Langflow process running as root (default)

Where this breaks in practice:

Running Langflow as a non-root user in a hardened container would limit post-exploitation — but this is not the default, and most deployments do not do it

Detection/coverage: EDR/host-based detection of child processes spawned by the Python/Langflow process (e.g., /bin/sh, curl, wget). Sysmon or auditd rules for unexpected exec calls from the Langflow PID.

STEP 04

Harvest credentials and secrets

Attackers immediately pivot to credential theft. Observed in-the-wild payloads enumerate LANGFLOW_SUPERUSER, OPENAI_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, ANTHROPIC_API_KEY from environment variables. They also read /root/.cache/langflow/secret_key, .env files, SSH private keys from /root/.ssh/, and .bash_history. This yields cloud API keys, database credentials, and SSH keys for lateral movement. Over 15,000 successful exploits have been recorded across related Langflow CVEs in 2026.

Conditions required:

Root shell obtained in Step 3

Where this breaks in practice:

Secrets stored in a dedicated vault (not env vars) would limit this — but Langflow's documentation defaults to env var configuration

Detection/coverage: Monitor for reads of /proc/self/environ, /root/.ssh/, and /root/.cache/langflow/ by the Langflow process. Cloud providers' anomalous-API-usage alerts for stolen keys.

STEP 05

Lateral movement and cloud compromise

With harvested AWS keys, OpenAI tokens, and SSH keys, attackers pivot to cloud environments (S3 buckets, EC2 instances, IAM escalation) and internal hosts via SSH. The stolen Langflow superuser secret enables persistence on the Langflow instance itself. Documented post-exploitation includes implanting backdoors and checking for prior attacker presence, suggesting multiple threat actors are competing for the same targets.

Conditions required:

Valid credentials obtained in Step 4
Target cloud accounts or internal hosts reachable from compromised Langflow server

Where this breaks in practice:

MFA on cloud accounts would block API-key-only access for console actions
Network segmentation limiting Langflow's egress and lateral reach

Detection/coverage: CloudTrail/CloudWatch alerts for API calls from unexpected source IPs. SSH login alerts from the Langflow server's IP to internal hosts.

03 · Compensating Control

CRITICAL 9.8→MEDIUM 5.5

SEVERITY REDUCED

Immediately remove Langflow from internet exposure — Place all Langflow instances behind a VPN, zero-trust proxy, or firewall that blocks all inbound access from untrusted networks. This is the single most impactful control because the entire attack chain requires network reachability to the /api/v1/validate/code endpoint. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days — but given active exploitation and no patch, do this within hours. Any instance that was internet-reachable during August–October 2026 should be treated as potentially compromised.

CRITICAL 9.8→LOW 3.1

SEVERITY REDUCED

Block POST requests to /api/v1/validate/code at the WAF or reverse proxy — Deploy a WAF rule or reverse-proxy ACL that denies all POST requests to /api/v1/validate/code. This surgically disables the vulnerable endpoint without taking Langflow offline. Note: this will break Langflow's custom component editor (code validation), but the core workflow execution continues to function. Deploy within 3 days per the noisgate mitigation SLA.

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Run Langflow as a non-root user in a hardened container — Redeploy Langflow under a dedicated unprivileged user account inside a read-only container with no SSH keys, minimal environment variables, and dropped Linux capabilities (--cap-drop=ALL). This does not prevent RCE but limits the blast radius: the attacker gets a low-privilege shell with no access to /root/.ssh/, /root/.cache/, or host-level secrets. Deploy within 3 days.

CRITICAL 9.8→CRITICAL 9.8

Rotate all credentials stored in or accessible to Langflow — Immediately rotate all API keys (OpenAI, Anthropic, AWS, GCP), database credentials, Langflow superuser secrets, and SSH keys that were accessible from any Langflow instance. Revoke old keys; do not merely add new ones. Check CloudTrail, OpenAI usage logs, and SSH auth logs for unauthorized access using the old credentials. This is a response action, not a preventive control — but it limits the value of already-exfiltrated secrets. Execute immediately.

CRITICAL 9.8→HIGH 8.5

SEVERITY REDUCED

Deploy network-level detection for exploitation IoCs — Add IDS/IPS signatures matching POST requests to /api/v1/validate/code containing exec(, subprocess, __import__, or check_output in the JSON body. Block source IP ranges 185.177.72.0/24, known GCP scanner IPs (35.200.23.10, 35.229.191.244, 35.233.194.235), and DigitalOcean scanner 142.93.57.244. These are documented IoCs from F5 Labs' September 2026 analysis. Deploy within 3 days.

What doesn't work

Setting LANGFLOW_AUTO_LOGIN=false — While this enforces authentication on the Langflow UI, the /api/v1/validate/code endpoint is unauthenticated *by design* and is not protected by this setting. This control gives a false sense of security.
IP-based rate limiting alone — Attackers are using distributed infrastructure (55+ IPs across multiple cloud providers and geographies). Rate limiting slows reconnaissance but does not prevent exploitation; a single request is sufficient for RCE.
Upgrading to Langflow 1.4.2 — Version 1.4.2 is itself vulnerable. There is no confirmed patched version. Upgrading to the 'latest' without verifying a specific fix for CVE-2026-0768 in the changelog does not remediate the vulnerability.
Content-type filtering — The exploit uses a legitimate application/json content type with a valid JSON structure. There is nothing anomalous about the request format; only the *content* of the code field is malicious.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Active since late August 2026. VulnCheck detected 50+ exploitation attempts on UK honeypots within hours on Aug 30, rising to 360+ by Aug 31. F5 Labs recorded 405 events from 55 distinct source IPs across September, with a peak of 162 events on Sept 26. Traffic primarily from Russia, with additional sources in GCP (35.x), DigitalOcean, and China (61.163.x, 125.46.x). Multiple threat actors operating concurrently.
Proof-of-Concept Availability	Extensively weaponized. Standalone PoC: rmhowe425/POC-CVE-2026-0768. Metasploit module: `exploit/multi/http/langflow_unauth_rce_cve_2026_0768` (PR #21864). Nuclei template: PR #17250 (shipped in v10.4.9). Automated exploitation framework: FlowHound by rmhowe425.
EPSS	0.08451 (8.45%) — top ~8th percentile of all CVEs. High probability of exploitation in the next 30 days, consistent with observed in-the-wild activity.
CISA KEV Status	Not listed for CVE-2026-0768 as of October 2026. However, a related Langflow CVE (CVE-2026-33017) was added to KEV — Langflow became the first AI agent platform in the KEV catalog. Given active exploitation evidence, KEV addition for this CVE appears imminent.
CVSS Vector	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — every exploitability metric at worst case: network-accessible, low complexity, no privileges, no user interaction. Full CIA impact. This vector accurately reflects the real attack surface.
Affected Versions	All Langflow versions ≤ 1.4.2. This is a bypass/variant of CVE-2025-3248 (fixed in 1.3.0), meaning the earlier patch was insufficient. The validate_code endpoint was re-exploitable in versions 1.3.0 through 1.4.2.
Patched Version	No confirmed patched version as of October 2026. Langflow has not published a vendor advisory with a fixed release. Defenders should monitor Langflow GitHub releases and treat any internet-exposed instance as vulnerable until a confirmed fix ships.
Exposure Data	Censys: ~7,000 internet-facing Langflow instances (169% increase over 9 months). Shodan: ~1,050 instances. One researcher estimated up to 74,000 with broader fingerprinting. Predominantly North America, with growing deployment in APAC and Europe.
Disclosure Timeline	July 2025: Reported to ZDI by Peter Girnus (@gothburz), William Gamazo Sanchez, and Alfredo Oliveira of Trend Research. January 23, 2026: Public disclosure as ZDI-26-034. Late August 2026: First in-the-wild exploitation detected. September 2026: Mass exploitation campaigns targeting credential theft.
Reporting Researchers	Peter Girnus (@gothburz), William Gamazo Sanchez, and Alfredo Oliveira — Trend Micro Zero Day Initiative (Trend Research). Exploitation research by rmhowe425 (Metasploit module, FlowHound, standalone PoC). Detection by VulnCheck (Caitlin Condon), F5 Labs, and Horizon3.ai (Naveen Sunkavally — original CVE-2025-3248 research).

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Zero friction in the attack chain: The entire exploit is a single unauthenticated HTTP POST request. No credentials, no user interaction, no complex preconditions. AV:N/AC:L/PR:N/UI:N — every exploitability dimension is at worst case. There is literally nothing between the attacker and root-level RCE except network reachability.
Active mass exploitation with no available patch: This is functionally a zero-day under active exploitation. 405+ events from 55 IPs documented by F5 Labs in September 2026 alone. Multiple threat actors are competing for the same targets. The vendor has not released a fix as of October 2026, nine months after disclosure.
Extensive weaponization lowers the bar to zero: Metasploit module, Nuclei template, FlowHound automated exploitation framework, and standalone PoC are all public. Any script kiddie with msfconsole can pop a Langflow instance in under 60 seconds.
Root-level execution by default: Langflow's default installation runs as root, giving attackers immediate full-privilege access to the host, all stored secrets, and the ability to pivot.
Role multiplier — secret store and CI/CD-adjacent component: Langflow is *designed* to store cloud API keys (OpenAI, AWS, Anthropic, database credentials) and is increasingly used as a CI/CD-adjacent tool for building and deploying AI agents. Compromise yields not just host-level access but cloud account takeover via harvested AWS keys and supply-chain contamination of AI workflows. While Langflow is not canonically a Tier-1 infrastructure component (it's not a DC, hypervisor, or IdP), its role as a secrets-bearing AI orchestration platform means the blast radius extends from host → cloud tenant → AI supply chain. With ~7,000 internet-facing instances and active credential-theft campaigns documented, the high-value-role outcome (cloud account compromise, AI supply-chain pivot) is not theoretical — it is happening now.
Role multiplier — 7,000+ internet-facing instances: Unlike niche internal-only tools, Langflow has significant internet exposure. Censys shows ~7,000 instances, and the installed base is growing 169% year-over-year. This is not a narrow attack surface.

Why not higher?

The score is already at 9.8, the practical maximum for a Scope:Unchanged vulnerability. A 10.0 would require Scope:Changed (the exploit propagating beyond the vulnerable component's security authority), which does not apply here — the RCE is confined to the Langflow host, even though post-exploitation pivoting extends the blast radius. The vendor's 9.8 is the correct ceiling.

Why not lower?

Every downward pressure requires demonstrating friction or limited exposure. This vulnerability has *neither*. Unauthenticated remote access: no friction. Single HTTP request: no complexity. Running as root: maximum impact. No patch available: no remediation path. Active exploitation: not theoretical. 7,000 internet-facing instances: not niche. Multiple weaponized tools: no attacker skill barrier. There is no credible argument for downgrading this below CRITICAL.

06 · Verification

Crowdsourced verification payload.

Run this script on each host where Langflow may be installed, or point it at a remote Langflow URL from an auditor workstation. Requires curl and either pip or network access to the target. Usage: bash check_cve_2026_0768.sh [http://langflow-host:7860]. No elevated privileges required for remote check; local version check needs read access to the Python environment.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_0768.sh — Detect CVE-2026-0768 (Langflow unauthenticated RCE)
# Usage: bash check_cve_2026_0768.sh [TARGET_URL]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

VULN_CEILING="1.4.2"
TARGET="${1:-}"
RESULT="UNKNOWN"

version_lte() {
  # Returns 0 if $1 <= $2
  printf '%s\n%s' "$1" "$2" | sort -V | head -n1 | grep -qx "$1"
}

# --- Method 1: Check locally installed Langflow version ---
if command -v pip3 &>/dev/null; then
  LOCAL_VER=$(pip3 show langflow 2>/dev/null | awk '/^Version:/{print $2}' || true)
  if [[ -n "$LOCAL_VER" ]]; then
    echo "[*] Local Langflow version detected: $LOCAL_VER"
    if version_lte "$LOCAL_VER" "$VULN_CEILING"; then
      echo "[!] VULNERABLE — local Langflow $LOCAL_VER <= $VULN_CEILING"
      RESULT="VULNERABLE"
    else
      echo "[+] Local version $LOCAL_VER is above $VULN_CEILING"
      echo "[!] WARNING: No confirmed patched version exists. Verify vendor changelog."
      RESULT="UNKNOWN"
    fi
  fi
fi

# --- Method 2: Check remote instance via /api/v1/version ---
if [[ -n "$TARGET" ]]; then
  echo "[*] Checking remote target: $TARGET"
  HTTP_RESP=$(curl -sk -m 10 -o /tmp/lf_ver.json -w '%{http_code}' "${TARGET}/api/v1/version" 2>/dev/null || echo "000")
  if [[ "$HTTP_RESP" == "200" ]]; then
    REMOTE_VER=$(grep -oP '"version"\s*:\s*"\K[^"]+' /tmp/lf_ver.json 2>/dev/null || true)
    if [[ -n "$REMOTE_VER" ]]; then
      echo "[*] Remote Langflow version: $REMOTE_VER"
      if version_lte "$REMOTE_VER" "$VULN_CEILING"; then
        echo "[!] VULNERABLE — remote Langflow $REMOTE_VER <= $VULN_CEILING"
        RESULT="VULNERABLE"
      else
        echo "[+] Remote version $REMOTE_VER is above $VULN_CEILING"
        echo "[!] WARNING: No confirmed patched version exists. Verify vendor changelog."
        RESULT="UNKNOWN"
      fi
    fi
  else
    echo "[*] Remote version endpoint returned HTTP $HTTP_RESP"
  fi

  # Check if the vulnerable endpoint is accessible (without sending exploit)
  echo "[*] Checking if /api/v1/validate/code is reachable..."
  VAL_RESP=$(curl -sk -m 10 -o /dev/null -w '%{http_code}' -X POST \
    -H 'Content-Type: application/json' \
    -d '{"code":"def test():\n  pass"}' \
    "${TARGET}/api/v1/validate/code" 2>/dev/null || echo "000")
  if [[ "$VAL_RESP" == "200" ]]; then
    echo "[!] EXPOSED — /api/v1/validate/code is accessible without authentication"
    if [[ "$RESULT" != "VULNERABLE" ]]; then
      RESULT="VULNERABLE"
    fi
  elif [[ "$VAL_RESP" == "401" || "$VAL_RESP" == "403" ]]; then
    echo "[+] /api/v1/validate/code returned $VAL_RESP (access restricted)"
  else
    echo "[*] /api/v1/validate/code returned HTTP $VAL_RESP"
  fi
  rm -f /tmp/lf_ver.json
fi

# --- Final verdict ---
echo ""
case "$RESULT" in
  VULNERABLE)
    echo "VULNERABLE"
    exit 1
    ;;
  PATCHED)
    echo "PATCHED"
    exit 0
    ;;
  *)
    echo "UNKNOWN"
    exit 2
    ;;
esac