Langflow Unauthenticated RCE via Code Execution Endpoint
An unauthenticated remote code execution flaw in Langflow allows attackers to run arbitrary Python code on exposed instances, enabling theft of AI API keys and cloud credentials.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 9.8
- EPSS (exploit probability)
- 22.9%
- Status
- exploited-in-wild
- Published
Is CVE-2026-0768 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-0768 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-21 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 22.9% (scored October 19, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-0768 is an unauthenticated remote code execution vulnerability in Langflow, an open-source, low-code framework for building AI-powered applications and agent workflows. The flaw carries a CVSS base score of 9.8 (critical) and is under active exploitation as of September 2026.
An unauthenticated attacker with network access to a Langflow instance can execute arbitrary Python code on the underlying host. Langflow instances are routinely configured with stored API credentials for integrated services, including OpenAI, Anthropic, AWS, and similar providers. Exploitation gives attackers direct access to those credentials without authentication.
Impact
Successful exploitation provides unauthenticated remote code execution on any internet-accessible Langflow instance. Because Langflow functions as an AI orchestration layer, compromised instances commonly expose API keys for multiple cloud providers and AI services. Those credentials enable unauthorized inference charges, cloud resource abuse, and potential pivot into connected infrastructure.
Mitigation
Restrict Langflow instance access to trusted internal networks; public internet exposure is not required for standard AI development workflows. Organizations with previously public-facing instances should rotate all stored API keys immediately and audit cloud provider billing and access logs for anomalous activity. Apply the patched Langflow release; consult the NVD entry for version details.
Other Langflow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-105740 Authenticated RCE via MCP tool additionwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2026-0770 Langflow validate-endpoint exec_globals RCE (unauthenticated)write-up | [ CRITICAL ] | 9.8 | 62.6% | |
| CVE-2026-55255 Langflow /api/v1/responses IDOR — cross-user flow executionwrite-up | [ HIGH ] | 8.4 | 0.9% | |
| CVE-2025-34291 Langflow CORS misconfiguration enables CSRF-driven token theft and RCEwrite-up | [ HIGH ] | 8.8 | 92.8% | |
| CVE-2026-33017 Langflow public flow build endpoint allows unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 24.8% | |
| CVE-2025-3248 Langflow unauthenticated code injection in validate/code endpointransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
