Langflow Unauthenticated RCE via Code Execution Endpoint
An unauthenticated remote code execution flaw in Langflow allows attackers to run arbitrary Python code on exposed instances, enabling theft of AI API keys and cloud credentials.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 9.8
- EPSS (exploit probability)
- 2.3%
- Status
- exploited-in-wild
- Published
CVE-2026-0768 is an unauthenticated remote code execution vulnerability in Langflow, an open-source, low-code framework for building AI-powered applications and agent workflows. The flaw carries a CVSS base score of 9.8 (critical) and is under active exploitation as of September 2026.
An unauthenticated attacker with network access to a Langflow instance can execute arbitrary Python code on the underlying host. Langflow instances are routinely configured with stored API credentials for integrated services, including OpenAI, Anthropic, AWS, and similar providers. Exploitation gives attackers direct access to those credentials without authentication.
Impact
Successful exploitation provides unauthenticated remote code execution on any internet-accessible Langflow instance. Because Langflow functions as an AI orchestration layer, compromised instances commonly expose API keys for multiple cloud providers and AI services. Those credentials enable unauthorized inference charges, cloud resource abuse, and potential pivot into connected infrastructure.
Mitigation
Restrict Langflow instance access to trusted internal networks; public internet exposure is not required for standard AI development workflows. Organizations with previously public-facing instances should rotate all stored API keys immediately and audit cloud provider billing and access logs for anomalous activity. Apply the patched Langflow release; consult the NVD entry for version details.
