\n September 1, 2026 \u00a0 \u00a0 <\/p>\n
![\"Attacks](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/09\/attacks-targeting-langflow-ai-agent-building-tool-surge-image_large-7-a-32712.jpg\")
\n Image: Shutterstock\/ISMG <\/p>\n
Popular open-source framework Langflow, used to build artificial intelligence agents and workflows, is under fire again from in-the-wild exploit attempts.<\/p>\n
See Also: Inside the 2026 Cyber Workforce: Key Trends, Talent Gaps, Strategic Shifts and the AI Revolution<\/a><\/p>\n Attackers on Saturday began attempting to target a vulnerability in Langflow that enables remote-code authentication without an attacker having to first authenticate, warned<\/a> cybersecurity firm VulnCheck. <\/p>\n The flaw in the “code validator in Langflow’s custom component editor,” tracked as CVE-2026-0768<\/a>, has a critical CVSS score of 9.8, and there were previously no known proof-of-concept exploits for the flaw circulating in the wild, said Caitlin Condon, vice president of security research at VulnCheck, in a LinkedIn post.<\/p>\n Attackers attempting to exploit the flaw first tripped VulnCheck’s canaries on Saturday. “Adversaries appear to be conducting a mix of reconnaissance and credential harvesting activities: Among other things, attacker requests are querying environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_ACCESS*, AWS_SECRET*), reading \/root\/.cache\/langflow\/secret_key, and checking .ssh access and .bash_history size,” she said.<\/p>\n Efforts to exploit the flaw remain active, with the firm counting 100 detections by its attack-detection canaries on Saturday, rising to 360 by Monday. “Source traffic primarily originates from Russia and has thus far exclusively hit canaries in the U.K.,” she said. <\/p>\n The project is owned by IBM, which acquired<\/a> the technology through its 2025 purchase of DataStax and has since integrated it into watsonx.ai, its integrated, end-to-end AI development platform. Hosted on GitHub<\/a>, Langflow is extremely popular, counting 409 contributors, 10,000 forks and 154,000 stars from users who have “favorited” the code repository.<\/p>\n While Langflow project release notes and IBM security bulletins don’t appear to specify if the vulnerability was patched or when, or to offer any other mitigations, VulnCheck said it appears to have been fixed. “The team who analyzed it on our side said it’s patched in 1.10.1. The team said the exploit relies on an exec() to execute malicious code, and that exec() was removed in the patch,” Condon told ISMG. That version was released on June 23. IBM and Langflow didn\u2019t immediately respond to a request for comment.<\/p>\n The now-targeted vulnerability was first discovered in version 1.4.2<\/a> of Langflow by researchers at Trend Micro, who reported<\/a> the zero-day flaw to Langflow in July 2025 through Trend’s Zero Day Initiative.<\/p>\n “The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code,” and “an attacker can leverage this vulnerability to execute code in the context of root,” the researchers said in a coordinated public disclosure on Jan. 9 that contains only high-level details pertaining to the flaw.<\/p>\n “Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product,” the researchers wrote at the time.<\/p>\n Valuable Target<\/p>\n Langflow is a repeat target for attackers since hackers prize all the access and resources AI tooling infrastructure can facilitate. “Langflow and similar AI projects often have access to compute resources, keys to systems with sensitive data and exposure to other high value systems. In layman’s terms, the exact type of system an attacker would find very valuable,” VulnCheck reported<\/a>.<\/p>\n Despite such targeting, outdated versions of Langflow with known vulnerabilities appear to abound.<\/p>\n In July, security researchers warned that a threat actor codenamed Jadepuffer was targeting an authentication flaw in Langflow tracked as CVE-2025-3248<\/a> to remotely execute code on a server without having to log in. The goal of those attacks was to deploy ransomware designed to target AI models and training data, as well as databases, and demand a ransom in return for decryption keys (see: Jadepuffer Redux: Bigger and Meaner the Second Time Round<\/a>). <\/p>\n In the wake of those attacks, cybersecurity firm Sysdig published a raft of defensive recommendations for Langflow users, including upgrading to version 1.3.0 or later, restricting access to the Docker interface to blow attackers’ attempts to gain escalated privileges, locking down permissions for directories storing AI data and ensuring all such data was being safeguarded through immutable backups.<\/p>\n The attack was a concern in part because the Langflow project released version 1.3.0 in April 2025, meaning that over one year later, attackers were able to compromise users who hadn’t yet updated.<\/p>\n That’s despite the U.S. Cybersecurity and Infrastructure Security Agency first warning<\/a> on May 5, 2025, that the vulnerability was being actively exploited. <\/p>\n By June 2025, Trend Micro reported<\/a> seeing attackers actively abuse the vulnerability to infect servers with Flodrix botnet malware. “Once the malware is successfully installed and establishes a connection with the command and control (C&C) server, it can receive commands over TCP to launch various distributed denial-of-service (DDoS) attacks,” the researchers said.<\/p>\n VulnCheck said its full list of known exploited vulnerabilities in Langflow includes an additional 10 flaws, all of them discovered this year. The firm has a different approach to counting KEVs than CISA, which reflects in part intelligence gathered by its canaries that reveals working exploits (see: Many More Bugs But Exploits Stay Steady<\/a>). <\/p>\n Three of those additional, known vulnerabilities in Langflow – not counting CVE-2026-0768 – have so far been targeted over 15,000 times in the wild this year, VulnCheck said. The greatest number of vulnerable Langflow hosts by far are running in the United States, followed by Germany, Malaysia, Brazil, India, France, Singapore, Canada and the United Kingdom.<\/p>\n One challenge for Langflow users is that the software is designed by default to be publicly accessible. <\/p>\n “Langflow’s first deployment model is designed to be deployed as an internet accessible service, allowing public access to your project’s MCP server provides a shareable playground where external users interact with the flow’s chat input and output and view results without having to install Langflow or generate an API key,” VulnCheck said. <\/p>\n “This increases the probability of internet exposure. And while Langflow does provide security best practices, it’s likely there are plenty of new adopters that brush over the best practices,” it said.<\/p>\n