CVE-2026-0768 Exploitation Targets AWS and OpenAI Credentials

Attackers are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, with observed activity focused on discovering credentials and secrets stored on exposed systems.

VulnCheck-observed attacks queried environment variables and local files for OpenAI API keys, AWS credentials, Langflow administrative secrets, SSH information, and shell history. On September 1, 2026, VulnCheck reported that exploitation attempts against its UK canary infrastructure had increased to 360.

Successful exploitation can provide arbitrary Python code execution without authentication and, according to the Zero Day Initiative (ZDI), execute code in the context of root. Credentials accessible to the compromised Langflow process could provide attackers with access to connected cloud accounts, AI services, and development infrastructure, depending on the permissions associated with those credentials.

CVE-2026-0768 is a code-injection vulnerability tracked by the Zero Day Initiative as ZDI-26-034, with internal identifier ZDI-CAN-27322. ZDI rates the vulnerability Critical at CVSS 9.8, with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. It is classified as CWE-94, Improper Control of Generation of Code.

The flaw exists in Langflow's handling of the `code` parameter supplied to its validation functionality. According to ZDI, attacker-controlled input is insufficiently validated before being used to execute Python code. Authentication is not required, and successful exploitation can execute code in the context of root.

Contemporary reporting identifies Langflow releases through version 1.4.2 as affected. Organizations should verify deployed versions rather than treating every internet-facing Langflow instance as vulnerable.

ZDI's disclosure timeline shows that the vulnerability was reported to the vendor on July 18, 2025. ZDI requested updates in September and October before notifying the vendor on December 10, 2025, that it intended to publish the case as a zero-day advisory. ZDI publicly disclosed ZDI-26-034 on January 9, 2026.

By September 1, 2026, CVE-2026-0768 had moved from vulnerability research into observed exploitation.

VulnCheck initially detected at least 50 exploitation attempts against UK-based honeypots over the preceding weekend. The reported count subsequently increased to 360. Much of the observed traffic originated from Russian infrastructure, but source geography does not establish the identity, nationality, or sponsorship of the operators. No named threat actor has been reliably attributed to the activity.

The activity is consistent with credential discovery and reconnaissance following exploitation, rather than code execution alone. This distinction is important during incident response: patching a previously exposed Langflow deployment closes the vulnerable condition but does not invalidate credentials that an attacker may already have obtained.

In its August 22-28 Initial Access Intelligence release, VulnCheck reported that it had developed an exploit for CVE-2026-0768 along with a Docker target, version scanner, PCAPs, and Snort and Suricata rules. Its Shodan query identified just under 2,500 internet-exposed Langflow instances.

That figure should not be interpreted as approximately 2,500 vulnerable servers. The Shodan result measures internet-visible Langflow instances, and VulnCheck's public release note does not establish that every identified instance was running an affected version.

There is also an important distinction around exploit availability. Reporting on September 1 stated that no known public proof-of-concept exploit was available, while VulnCheck had already developed an exploit within its Initial Access Intelligence offering. The absence of a freely available public PoC therefore does not imply the absence of working exploitation capability. VulnCheck's canary observations independently establish active exploitation.

Langflow is an open-source, Python-based low-code platform for building AI applications and workflows, including integrations with language models, databases, APIs, and other tools. Those integrations can make credentials accessible to the application particularly valuable following server compromise.

Possession of an AWS access key does not itself establish compromise of an AWS environment. Downstream access depends on the credential's validity, permissions, and applicable security controls. Similar constraints apply to OpenAI API keys and other application secrets.

Nevertheless, defenders should treat exploitation of CVE-2026-0768 as a potential credential-compromise event, not solely as a vulnerable-server event. Root-context code execution combined with observed searches for cloud and application credentials warrants investigation of both the Langflow host and services accessible with secrets stored there.

CVE-2026-0768 also appears against a broader backdrop of Langflow exploitation in 2026. SecurityWeek reported that VulnCheck had identified 11 additional Langflow vulnerabilities as targeted and reported exploited in the wild during 2026, indicating sustained attacker interest in the platform.

Organizations operating Langflow should identify deployed instances, particularly development, testing, and internet-facing systems, and prioritize systems that were exposed while running affected releases.

• Upgrade to a current supported Langflow release. September 1 reporting identified Langflow 1.11.6 as the latest available version at that time. ZDI's advisory does not identify the first fixed release for CVE-2026-0768, so defenders should avoid assuming a specific minimum patched version without confirmation.
• Remove unnecessary internet exposure. ZDI's stated mitigation is to restrict interaction with the affected product. Internet-facing deployments should be limited to instances with a documented requirement and appropriate access controls.
• Assess previously exposed systems for compromise. Review application, web, endpoint, container, and network telemetry for suspicious interaction with the vulnerable validation functionality, unexpected Python or system execution, credential discovery, and unusual outbound activity.
• Investigate credential exposure. Determine whether environment variables, Langflow secrets, OpenAI credentials, AWS credentials, SSH material, or shell history were accessible to the Langflow process. These categories correspond to information sought in observed attacks.
• Rotate potentially exposed secrets after containment. Credentials accessible to a potentially compromised process should be rotated or revoked according to their exposure risk. Updating Langflow does not invalidate credentials an attacker may already have obtained.
• Investigate downstream use. Review AWS and other connected services for suspicious authentication, API calls, or resource changes involving credentials that were accessible from the affected system.
• Deploy network detections where available. VulnCheck has produced PCAPs and Snort and Suricata rules for CVE-2026-0768 as part of its Initial Access Intelligence content.

Where compromise is established, responders should not limit their investigation to the Langflow container or host. VulnCheck's observed activity specifically sought credentials that may remain valid after remediation of the vulnerable application.

For long-term hardening of exposed application surfaces and secret handling, see our guide to Managed Cybersecurity for GCC SMBs.

There is no verified attribution connecting the observed CVE-2026-0768 exploitation to a named threat actor. Although much of the traffic observed by VulnCheck was reported as originating from Russian infrastructure, that fact alone does not establish operator nationality, identity, or sponsorship.

The reviewed evidence also does not identify specific victim organizations whose AWS or OpenAI accounts were subsequently compromised using credentials obtained through CVE-2026-0768. Observed credential harvesting establishes a credible downstream risk, but it is not evidence that secondary cloud or AI-service compromise occurred.

Active exploitation is established by VulnCheck's observations independently of CISA Known Exploited Vulnerabilities catalog status.

For organizations that exposed an affected Langflow deployment to the internet, remediation should extend beyond installing an update. The September 1 activity reported by VulnCheck included searches for Langflow administrative information, AWS secrets, OpenAI API keys, SSH information, and shell history.

Defenders should remove the exploitable condition while determining what information the Langflow process could access before remediation. Network, endpoint, application, container, and cloud telemetry should then be correlated to identify potential exploitation, credential access, and subsequent use of exposed secrets.