Langflow flaw is being exploited to harvest cloud and AI credentials
Image: Primary Threat actors are exploiting CVE-2026-0768, an unauthenticated remote-code-execution flaw in Langflow's custom-component code validator, to steal credentials, tokens and keys, according to VulnCheck observations reported by BleepingComputer. The critical issue affects Langflow 1.4.2 and earlier and can execute arbitrary code with root privileges. VulnCheck observed 360 attacks as of September 1, including attempts to collect OpenAI API keys, AWS secrets and Langflow administrative credentials.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
