Attackers Exploit Langflow to Steal OpenAI, AWS Keys

CVE-2026-0768, a critical unauthenticated remote code execution flaw in Langflow, is under active exploitation. BleepingComputer reported that attackers are targeting exposed Langflow instances specifically to extract stored API credentials: OpenAI keys, AWS access tokens, and similar cloud-service secrets. SecurityWeek confirmed the exploitation activity based on multiple incident reports.

Langflow is an open-source, low-code platform for building AI agent workflows and applications. Organizations use it to wire together language models, data sources, and APIs without substantial custom code. That convenience comes with a credential footprint: a running instance typically holds API keys for the models and services it integrates, usually stored as environment variables. CVE-2026-0768 allows an unauthenticated attacker to execute arbitrary Python code on the host, which makes those stored credentials directly accessible.

The CVSS 9.8 score reflects a direct, low-complexity attack path: no credentials required, no prior access, just network reach to an exposed Langflow instance. VulnCheck researchers, cited by The Hacker News, observed exploitation alongside active abuse of a critical Ruby on Rails flaw, suggesting a coordinated campaign against developer tooling rather than opportunistic scanning.

The credential theft is the goal, not a stepping stone. An OpenAI key authorizes whoever holds it to run inference against a victim’s account, running up charges and potentially accessing fine-tuned models or stored data. AWS credentials carry broader access: storage buckets, compute instances, IAM permissions, and whatever else is running in that account. Attackers targeting Langflow specifically are going for the aggregation point: the layer where multiple high-value API credentials live together, unguarded once the application layer is compromised.

This follows a recognizable pattern. The LiteLLM supply-chain attack earlier this year targeted the same position in the AI stack, one step removed from the model APIs, because routing and orchestration layers aggregate keys from many providers. JFrog Artifactory’s actively exploited CVE-2026-82329 and the ServiceNow AI platform RCE from July follow the same logic: compromise the infrastructure that talks to everything else, because that is where the credentials concentrate.

Langflow instances should not be internet-exposed for most development workflows. Organizations that have run public instances should rotate API keys immediately, audit cloud billing and access logs for unexpected usage, and apply the patched version of Langflow. The NVD advisory and SecurityWeek’s reporting cover version-specific details.

Developer AI tooling ships optimized for experimentation first. Security hardening follows later. That gap rarely stays quiet for long.