Hackers Are Actively Exploiting a Critical Flaw in the AI Builder Langflow

Key points

• A critical security flaw in Langflow, tracked as CVE-2026-0768, carries a severity score of 9.8 out of 10 and lets attackers run any code they like on a target server without logging in.
• All versions of Langflow up to and including 1.4.2 are affected; the patch landed in version 1.4.3.
• Attackers, mostly originating from Russian IP addresses, are using the flaw to harvest passwords, secret keys, and remote-access credentials.
• Vulnerability intelligence firm VulnCheck recorded more than 360 exploitation attempts against its detection sensors in the UK by Monday alone.
• VulnCheck has counted more than 15,000 successful attacks across three Langflow flaws in 2026 so far.

What is Langflow, and who uses it?

Langflow is a low-code platform, meaning it lets developers build AI-powered applications by dragging and connecting blocks on a screen rather than writing every line of code from scratch. Businesses use it to create customer chatbots, document analysis tools, and other AI workflows. Many installations sit on servers that face the public internet.

What is the flaw, and how serious is it?

Serious enough that the industry's standard severity scale gives it 9.8 out of 10. The problem sits inside Langflow's custom component editor, a feature that lets users define their own building blocks using Python code. That code should be carefully checked before the server runs it. It is not.

Because Langflow fails to properly validate what a user submits, a criminal can send a specially crafted request and force the server to run whatever instructions they choose, as the most privileged user on the machine, with no password required. Security researchers call this unauthenticated remote code execution, meaning a complete server takeover from anywhere on the internet, no account needed.

The flaw was reported through the Zero Day Initiative (ZDI), a programme that coordinates responsible disclosure of new vulnerabilities, back in July 2025. It became public knowledge as a zero-day, meaning a flaw actively exploited before the software maker could issue a fix, in January 2026.

What are attackers actually doing with it?

Stealing credentials. VulnCheck, which first raised the alarm, observed criminals querying Langflow servers for environment variables (stored configuration values that often contain passwords and API keys), SSH keys (digital credentials used to log into servers remotely), and other secrets. Most of the malicious traffic traced back to Russian addresses.

Before 2026, only one Langflow vulnerability had been confirmed as actively exploited. This year, according to VulnCheck, that number jumped to twelve, suggesting criminal groups have identified Langflow as a productive target.

Should IT teams act immediately?

Yes. Update to Langflow 1.4.3 now. If an immediate update is not possible, take the server offline or block all public internet access to it until the patch is applied. Then audit logs for any unexpected outbound connections or queries touching environment variables, which would suggest the server was already reached.

Organisations that use Langflow to handle customer data or internal systems should also rotate any secrets, API keys, and passwords stored on or near those servers, just in case credentials were already copied before the patch goes in. As SecurityWeek noted, exploitation of this flaw has been active and measurable, not merely theoretical.