Langflow code Code Injection Remote Code Execution Vulnerability.

CVE-2026-0768 is a code injection flaw in Langflow's /api/v1/validate/code endpoint — the custom component editor's code-validation function calls Python exec() on attacker-supplied input without authentication. Because Langflow typically runs as root in Docker, successful exploitation yields root-level arbitrary code execution with zero clicks, zero credentials, and zero user interaction. All versions through 1.4.2 are affected; the fix ships in 1.11.6. The attack surface is any Langflow instance reachable over HTTP — default port 7860.

The vendor's CVSS 9.8 CRITICAL is accurate and, if anything, undersells the operational impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) faithfully describes a trivial, fully unauthenticated remote chain. Active exploitation was confirmed by VulnCheck on September 2, 2026 — one day ago — with 360+ canary detections in under 48 hours, credential theft targeting AWS keys, OpenAI API keys, and SSH material, and traffic sourced primarily from Russian IPs aimed at UK-based honeypots. This is not theoretical.

Why this verdict

• Unauthenticated RCE with zero friction: The vulnerable endpoint requires no credentials, no user interaction, and has low attack complexity. There is literally nothing between the attacker and code execution except HTTP connectivity.
• Active exploitation confirmed yesterday: VulnCheck documented 360+ exploit attempts in 48 hours (Aug 30–31), with confirmed credential theft campaigns targeting AWS keys, OpenAI API keys, and SSH material as of Sept 2, 2026.
• Root-level execution in default deployment: Langflow's official Docker image runs as root with no seccomp/AppArmor profile, meaning successful exploitation grants the attacker the highest possible privileges on the host.
• Role multiplier: Langflow occupies a *credential-store and CI/CD-adjacent* role in most deployments. It routinely holds AWS access keys, OpenAI API keys, database connection strings, and SSH keys — making it a secret manager equivalent for AI/ML workflows. Compromise yields cloud account takeover (fleet-scale blast radius via AWS IAM escalation) and lateral movement via SSH keys. While Langflow is not canonically a DC or hypervisor, its credential-store function means the blast radius extends well beyond the single host. For organizations running Langflow with production cloud credentials, the outcome is cloud account compromise and supply-chain risk to AI/ML pipelines — this clears the HIGH floor and supports CRITICAL.
• Exploit simplicity: The technique (decorator/default-arg injection into Python exec()) is trivial to reproduce from the advisory alone, even without a public PoC. The absence of a public PoC has not prevented mass exploitation.

Why not higher?

The score is already at 9.8, the practical ceiling for CVSS 3.x with Scope:Unchanged. The only path to 10.0 would require Scope:Changed, which does not apply here since the vulnerable component and impacted component are the same Langflow server process.

Why not lower?

Despite the small internet-facing population (~500 instances), downgrading would be irresponsible given active exploitation confirmed one day ago, the complete absence of any authentication barrier, root-level execution, and documented credential theft leading to cloud account compromise. The small absolute footprint is irrelevant to organizations that *do* run Langflow — for them, the blast radius is cloud-account-scale. Additionally, internal Langflow instances are reachable post-initial-access with identical zero-auth exploitation.

1. Block all external access to Langflow immediately — Place Langflow behind a VPN, SSH tunnel, or zero-trust proxy (Cloudflare Access, Tailscale, etc.) today — within hours, not days. This is the single highest-impact mitigation. Per the noisgate mitigation SLA for CRITICAL, deploy within 3 days, but given active exploitation, treat this as an emergency.
2. Enforce authentication proxy in front of /api/v1/validate/code — If you cannot upgrade immediately, deploy a reverse proxy (nginx, Caddy, Traefik) that requires authentication for all API routes, especially /api/v1/validate/code. This blocks the unauthenticated attack vector. Deploy within 3 days per noisgate mitigation SLA.
3. Run Langflow as non-root with read-only filesystem — Reconfigure the Docker container with --user 1000:1000, --read-only, and drop all capabilities (--cap-drop=ALL). This limits post-exploitation impact even if code injection succeeds. Deploy within 3 days.
4. Rotate all credentials stored in Langflow environment — Immediately rotate AWS access keys, OpenAI API keys, Langflow secret_key, and any SSH keys accessible from the Langflow host. Attackers are actively harvesting these. Do this within hours if you have any internet-exposed Langflow instance.
5. Restrict outbound network from Langflow containers — Apply egress filtering to allow only necessary outbound connections (LLM API endpoints, database). This prevents exfiltration of harvested credentials. Deploy within 3 days.

Run this script on each host running Langflow (or from a central auditor with SSH access). It checks the installed Langflow version against the vulnerable range. Requires pip or access to the Langflow container. Example: bash check_cve_2026_0768.sh — no special privileges needed beyond ability to query the Python package version.

#!/usr/bin/env bash
# check_cve_2026_0768.sh — Detect CVE-2026-0768 in Langflow
# Tests whether the installed Langflow version is <= 1.4.2 (vulnerable)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

set -euo pipefail

VULN_MAJOR=1
VULN_MINOR=4
VULN_PATCH=2

# Try to get Langflow version from pip
if command -v langflow &>/dev/null; then
  VERSION=$(langflow --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
elif command -v pip &>/dev/null; then
  VERSION=$(pip show langflow 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
elif command -v pip3 &>/dev/null; then
  VERSION=$(pip3 show langflow 2>/dev/null | grep -i '^Version:' | awk '{print $2}')
elif command -v docker &>/dev/null; then
  VERSION=$(docker exec $(docker ps --filter ancestor=langflowai/langflow -q 2>/dev/null | head -1) pip show langflow 2>/dev/null | grep -i '^Version:' | awk '{print $2}' 2>/dev/null)
fi

if [ -z "${VERSION:-}" ]; then
  echo "UNKNOWN — Langflow not found or version could not be determined."
  exit 2
fi

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
PATCH=${PATCH%%[^0-9]*}  # strip any pre-release suffix

echo "Detected Langflow version: $VERSION"

if [ "$MAJOR" -lt "$VULN_MAJOR" ] || \
   { [ "$MAJOR" -eq "$VULN_MAJOR" ] && [ "$MINOR" -lt "$VULN_MINOR" ]; } || \
   { [ "$MAJOR" -eq "$VULN_MAJOR" ] && [ "$MINOR" -eq "$VULN_MINOR" ] && [ "${PATCH:-0}" -le "$VULN_PATCH" ]; }; then
  echo "VULNERABLE — Langflow $VERSION is affected by CVE-2026-0768 (<= 1.4.2)."
  echo "Upgrade to Langflow >= 1.11.6 immediately."
  exit 1
else
  echo "PATCHED — Langflow $VERSION is not affected by CVE-2026-0768."
  exit 0
fi

Sources

1. SecurityAffairs — Hackers Target Langflow in CVE-2026-0768 Attacks
2. SecurityWeek — Hackers Start Exploiting Critical Langflow Vulnerability
3. Horizon3.ai — Unsafe at Any Speed: Abusing Python Exec for Unauth RCE in Langflow
4. Dev.to — Exploitation of Langflow CVE-2026-0768: From Unauthenticated Root RCE to Secret Theft
5. SOCRadar — Langflow and Rails Exploitation Raises Credential Risks
6. NVD — CVE-2026-0768
7. SentinelOne Vulnerability Database — CVE-2026-0768
8. The Hacker News — Attackers Exploit Critical Langflow and Rails Flaws