Langflow's Twelfth Exploited Flaw of the Year Is Used to Read Secret Keys and SSH Access, Not to Deploy Ransomware (CVE-2026-0768)

Langflow instances exposed to the internet, concentrated in the US, Germany, Malaysia, Brazil, and India

VulnCheck recorded more than 50 exploitation detections within a few hours on August 30, 2026, rising to 360 by September 1. CVE-2026-0768 (CVSS 9.8) sits in the validate endpoint of Langflow's custom component editor, which passes a user-supplied `code` parameter to Python's `exec()` without sanitization, giving unauthenticated remote code execution as root; ZDI published it as a zero-day advisory on January 9, 2026. Langflow's default auto-login behavior compounds the exposure by leaving instances reachable with no authentication at all. The attacker behavior is what distinguishes this round: no ransomware and no wipers, just systematic enumeration of environment variables, reads of `/root/.cache/langflow/secret_key`, and checks for `.ssh` access, aimed at OpenAI and AWS keys, cloud provider credentials, and database connection strings. Traffic hitting the canaries came primarily from Russia and initially landed only on UK sensors. This is the twelfth Langflow vulnerability observed exploited in the wild during 2026, following three that reached the CISA KEV catalog between July and August, and researchers count more than 15,000 successful exploitation attempts across the adjacent cluster including CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. The same VulnCheck reporting covered concurrent exploitation of CVE-2026-66066 ("KindaRails2Shell", CVSS 9.5) in Ruby on Rails against canaries in Singapore, Israel, and the UK

An AI orchestration platform that evaluates user-supplied Python by design, ships with authentication disabled by default, and holds the provider keys for every model and data source a flow touches. Twelve exploited flaws in one year against one product is a statement about where the credentials are, not about the sophistication of the attackers