Loading story…
Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote-code-execution flaw in the Langflow AI low-code platform. Rated CVSS 9.8, the vulnerability affects Langflow versions through 1.4.2 and allows arbitrary Python code execution as root through insufficient validation in the custom-component editor’s code validator. VulnCheck recorded more than 360 exploitation attempts against U.K. canaries, largely from Russian-origin infrastructure, seeking environment variables, Langflow secrets, SSH details, and shell-history metadata.
The activity follows broader disclosures affecting Langflow OSS 1.x releases prior to 1.11.2, including critical and high-severity flaws enabling RCE, privilege escalation, arbitrary file reads, and information disclosure. Organizations should upgrade Langflow to the vendor-fixed releases—at least 1.11.2 where applicable—remove public exposure where possible, rotate credentials accessible to Langflow, and investigate for unauthorized environment-variable access, proxy deployment, cryptomining, audit-log changes, and lateral scanning. Public exploit development is also progressing: a proposed Metasploit module targets the separate authenticated RCE CVE-2026-5027.
See which actors are running it and whether you're in range.
16 events from the most recent confirmed update back to the earliest known activity.
Contributor rmhowe425 proposed and updated a Metasploit multi-platform HTTP exploit module, exploit/multi/http/langflow_unauth_rce_cve_2026_0768, for unauthenticated remote code execution through Langflow CVE-2026-0768. The module is configured with LHOST and RHOSTS values.
By Monday, VulnCheck had recorded more than 360 exploitation attempts against its United Kingdom canary systems targeting CVE-2026-0768. Most observed source traffic originated from Russia and sought environment variables, Langflow secret keys, and SSH-related information.
A GitHub contribution proposed the Metasploit module exploit/multi/http/langflow_auth_rce_cve_2026_5027 for authenticated exploitation of Langflow CVE-2026-5027. The displayed module requires an LHOST, RHOST, username, and password.
VulnCheck recorded more than 50 exploit detections within hours involving active exploitation of critical Langflow CVE-2026-0768 and the KindaRails2Shell Rails flaw, CVE-2026-66066. Langflow activity included reconnaissance and attempts to harvest credentials and secrets.
VulnCheck identified more than 7,100 exposed Ruby on Rails instances vulnerable to CVE-2026-66066 as of early August. The flaw can expose arbitrary server files, Rails environment data, and secrets under applicable Active Storage/libvips configurations.
A security patch for the critical unauthenticated Langflow RCE vulnerability CVE-2026-0768 became available. Langflow versions through 1.4.2 remained vulnerable.
CVE-2026-0768 was publicly disclosed as a Langflow zero-day vulnerability. Langflow releases through version 1.4.2 are affected.
The critical Langflow remote-code-execution vulnerability CVE-2026-0768 was reported through the Zero Day Initiative. The flaw affects the custom component editor code validator and can allow unauthenticated Python code execution as root.
A reported campaign combined unauthenticated Langflow RCE CVE-2026-33017 with the insecure direct object reference flaw CVE-2026-55255. The campaign targeted approximately 7,000 servers to obtain OpenAI and Anthropic API keys, AWS, Google Cloud, Azure, and database credentials.
VulnCheck tested Rails 8.1.3.1 and found that its patch blocked the libvips file-read technique but did not neutralize variation-key Marshal deserialization. It reported that an RCE gadget could still execute on a patched server when supplied with a valid signature.
VulnCheck detected active exploitation of Rails CVE-2026-66066 against canaries in Singapore, Israel, and the United Kingdom. Researcher Patrick Garrity reported that the observed activity originated from one French IP address and communicated with command-and-control infrastructure in Israel.
Attackers exploited CVE-2026-0769 to deploy a payload named .sysd and scan for additional targets, activity assessed as likely intended to expand cryptomining operations.
Attackers weaponized CVE-2025-3248 to add a compromised system to an XMR cryptocurrency-mining botnet. They disabled auditd during the incident, creating a forensic blind spot.
Unknown threat actors exploited Langflow CVE-2026-5027 against a VulnCheck canary, deploying a Python credential harvester, proxy agents, and SimpleHelp remote-access software. VulnCheck also reported over 15,000 successful attacks involving CVE-2026-5027, CVE-2026-0769, and CVE-2025-3248.
Eight vulnerabilities, including two critical and four high-severity issues, were identified in Langflow OSS. Reported impact categories include remote code execution, privilege escalation, arbitrary file reading, and information disclosure; Langflow 1.x releases before 1.11.2 are affected.
IBM announced security updates for six Langflow OSS vulnerabilities: CVE-2026-8446, CVE-2026-9077, CVE-2026-17623, CVE-2026-17625, CVE-2026-17626, and CVE-2026-17630. Versions 1.0.0 through 1.10.3 are affected, and version 1.11.0 or later remediates the listed issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
10 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcesecurityaffairs.com
Open sourceheise.de
Open sourcegithub.com
Open sourcegithub.com
Open sourceacn.gov.it
Open sourceboho.or.kr
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
A critical vulnerability in the LangChain-based no-code LLM development platform **Langflow** exposed internet-facing instances to unauthenticated remote code execution. Tracked as **`CVE-2025-3248`** and rated **CVSS 9.8**, the flaw was disclosed after researchers showed that unsafe use of Python `exec` could be abused through Langflow's code-validation functionality, allowing attackers to run arbitrary Python on vulnerable servers. Security monitoring by MBSD-SOC found exploitation attempts beginning on **April 10, 2025**, shortly after public disclosure on April 8. Attackers were observed sending crafted `POST` requests to the **`/api/v1/validate/code`** endpoint to execute malicious Python, including attempts to read sensitive files such as **`/etc/passwd`**. The report said proof-of-concept code and real-world abuse were already circulating, and urged organizations to update Langflow immediately; telemetry cited the **Netherlands** and **France** as the source of roughly half of observed attack traffic.
Aug 15, 2026