Langflow's exploited 9.8 RCE stayed invisible to vuln feeds

On Sunday 30 August, VulnCheck began logging exploit attempts against CVE-2026-0768 on its Langflow canaries — more than 50 within hours, and over 360 by Monday 31 August. The traffic came primarily from Russia and reached straight for the OpenAI and AWS keys on those boxes. And throughout, a team doing careful, tool-driven vulnerability management using only authoritative sources would not have had this flaw in front of them — the 9.8 root RCE is in no vendor advisory, not in CISA KEV, with an EPSS of 2.3%.

What the attackers are after: a machine built to be a key vault

The request list tells you whoever wrote the payload understood Langflow. Caitlin Condon, VulnCheck's VP of threat research, itemised it: LANGFLOW_SUPERUSER (the platform's own superuser credential), OPENAI_API* (OpenAI API keys), AWS_ACCESS* and AWS_SECRET* (cloud access keys), plus reads of /root/.cache/langflow/secret_key and checks of .ssh access and .bash_history size.

This is not what a random botnet operator wants. It is the specific set of secrets a Langflow deployment is likely holding. That follows from the deployment model: Langflow is a low-code builder for LLM applications whose visual editor sits on a network interface, and the flows it builds need model-provider API keys and data access. A machine running it is, almost by construction, the box where your organization keeps the keys to its AI spending — and frequently its cloud account. Root on that host is not a foothold on a random web server; it is the key box.

The flaw itself: a chain that should have ended 13 months ago

The mechanism is unremarkable. CVE-2026-0768 lives in the code validator of Langflow's custom-component editor: the validate endpoint takes a user-supplied string and executes it as Python code without proper validation — no authentication, execution as root. ZDI's description is blunt: remote attackers can execute arbitrary code on affected installations, authentication not required.

The timeline is the ugly part. ZDI published ZDI-26-034 on 9 January 2026 as a zero-day; the report had reached the vendor on 18 July 2025 — nearly six months before publication, and now more than thirteen months ago. CVSS 3.0 9.8 with the vector AV:N/AC:L/PR:N/UI:N — network-reachable, no auth, no interaction.

This is not Langflow's first rodeo: on 28 August, IBM documented three more code-execution flaws under the product name IBM Langflow OSS (affected 1.0.0–1.11.1, fixed in 1.11.2), and in March attackers weaponised CVE-2026-33017 within about a day of disclosure to harvest .ENV and database files.

Why vulnerability management cannot see it

Walk through every signal a defender uses to triage this flaw:

Nothing on the record is false. The gap is that the record was written once, in January, from a third-party disclosure, and nothing has updated it since June. Records maintained by exception decay quietly, and the decay is invisible until someone starts exploiting the thing. A team doing careful, tool-driven vulnerability management using only authoritative sources would not have this in front of them this week — and it is the one being used against them.

This is not a model attack. It is an AI-infrastructure attack

Put this in the right place in the AI-security story: no model escape, no prompt injection, no agent misbehaviour. Just an old, unpatched web flaw on a tool nobody put in the asset inventory, used to read environment variables. This is the AI-infrastructure compromise forecast in the abstract for two years, arriving as something ordinary — and ordinary is exactly why it is dangerous.

And be honest about scale: everything known about the exploitation comes from one firm's honeypots. 360 attempts against canaries in one country is a measure of scanning, not of compromise. Nobody has published a count of instances actually taken, and the vendor has said nothing. Treat the exploitation as real and the scale as unmeasured.

Three steps

The bottom line

For security teams, the lesson is not "another patch to deploy." It is that the vulnerability-management pipeline itself has a hole: an actively exploited 9.8 RCE can simultaneously be absent from vendor advisories, KEV and high EPSS. Treat this as a calibration signal — if your triage trusts only authoritative sources, you are as blind as everyone else who does. AI assets are where this bites hardest: they are the ones most likely running outside the inventory.

References

• Severity Daily: Langflow's 9.8 root RCE is being exploited for OpenAI and AWS keys, and the project's own advisory list has never mentioned it (2026-09-01) — https://severitydaily.com/langflow-cve-2026-0768-exploited-openai-aws-keys-no-vendor-advisory/
• BleepingComputer: Critical Langflow flaw exploited to steal OpenAI and AWS keys (2026-09-01) — https://www.bleepingcomputer.com/news/security/critical-langflow-flaw-exploited-to-steal-openai-and-aws-keys/
• ZDI-26-034 (Zero Day Initiative, 2026-01-09) — https://www.zerodayinitiative.com/advisories/ZDI-26-034/
• NVD record CVE-2026-0768 — https://nvd.nist.gov/vuln/detail/CVE-2026-0768