VulnCheck's UK honeypots logged at least 50 exploitation attempts against CVE-2026-0768 over the weekend of 29-30 August 2026, rising to 360 by 1 September. The interesting fact is the calendar, not the CVSS score: the flaw was disclosed in January via Trend Micro's Zero Day Initiative, affects Langflow 1.4.2 and earlier, and the current release is 1.11.6. The observed attacker requests — querying LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS and AWS_SECRET*, reading the Langflow secret key, checking .ssh and .bash_history — show what is actually at stake. This is not a server compromise. It is a credential-vault compromise, and the vault was assembled by convention rather than by design.
The vulnerability being exploited against Langflow servers this week is not new. CVE-2026-0768 was disclosed in January 2026 through Trend Micro's Zero Day Initiative. It affects Langflow 1.4.2 and earlier. The current release is 1.11.6. Attackers are using it in September because a meaningful population of Langflow instances has not moved in seven releases.
VulnCheck detected exploitation against its honeypots in the United Kingdom, logging at least 50 attempts over the weekend of 29 and 30 August with traffic originating primarily from Russia. By 1 September, lead security researcher Caitlin Condon said the observed total had reached 360. BleepingComputer reported the activity on 1 September; SecurityWeek and Dark Reading covered it the same day, with Dark Reading citing a CVSS score of 9.8.
The severity rating is the least interesting number in that paragraph. The interesting number is eight, the number of months between disclosure and the wave.
The flaw sits in the code validator of Langflow's custom component editor. The NVD entry places it in the handling of the code parameter passed to the validate endpoint, and attributes it to missing validation of a user-supplied string before that string is used to execute Python code. The consequence is arbitrary code execution, without authentication, with root privileges. Trend Micro's Zero Day Initiative advisory ZDI-26-034 describes the same root cause.
Lay the calendar out. Disclosed January 2026. Vulnerable range 1.4.2 and earlier. Fixed and superseded repeatedly since. Current version 1.11.6, which Langflow's maintainers say addresses all known flaws in the tool. Exploitation observed at scale from 29 August. Nothing in that sequence required a novel technique or a supply chain compromise. It required only that some number of internet-facing Langflow instances stayed exactly where they were.
The observed requests are the argument. According to Condon, attacker traffic queries the environment variables LANGFLOW_SUPERUSER, OPENAI_API, AWS_ACCESS and AWS_SECRET*; reads /root/.cache/langflow/secret_key; and checks .ssh access and the size of .bash_history. That is not the behaviour of someone who wants a server. It is the behaviour of someone who wants the keys the server is holding.
Understanding why those particular keys are there requires understanding what Langflow is for. It is an open-source, Python-based low-code platform for assembling AI applications, agents, chatbots and retrieval-augmented generation systems by wiring components together in a graphical interface: language models, prompts, databases, APIs, tools. For any of those components to actually call anything, the process needs credentials for everything downstream of it.
So the credentials are supplied the way credentials are usually supplied to a Python process, as environment variables. An OpenAI key so flows can call a model. AWS access and secret keys so flows can reach storage or a hosted model endpoint. A superuser credential for Langflow itself. A local secret key on disk for encrypting stored secrets. The result is a single process holding the union of every integration the team ever wired up.
An agent builder is a credential aggregator by construction. That is not a design flaw specific to Langflow; it is what any orchestration layer has to do. It does mean unauthenticated code execution on such a platform yields the organisation's provider stack rather than one application's data.
The distinction matters for incident response. A compromised web server usually means the data that server held. A compromised orchestration layer means every account those credentials unlock, at providers that have no idea anything has happened and will read the resulting API calls as legitimate traffic. The blast radius is defined by the integration list, not by the host.
CVE-2026-0768 is the sixth Langflow flaw exploited in the wild in 2026. In March, attackers leveraged CVE-2026-33017, a critical code injection flaw, within about a day of its disclosure, using it to execute Python scripts and harvest .ENV and database files. CVE-2026-5027, a path traversal issue, was used to write arbitrary files to vulnerable servers. CVE-2026-55255, an authentication bypass, allowed access to other users' AI workflows, data theft and second-stage implants, and CISA ordered federal agencies to prioritise patching it. CVE-2026-0770 was used to execute commands with root privileges and to attempt malware deployment and extraction of cloud credentials, environment variables and container metadata. Most recently CISA warned on CVE-2026-9198, after multiple public proof-of-concept exploits became available.
Six separately exploited vulnerabilities in one product in one calendar year, against a version gap running from 1.4.2 to 1.11.6, is not six unrelated bugs. It is a patch cadence problem with six symptoms. The project is shipping fixes. Something in the middle is not consuming them.
The structural reason is worth naming, because it generalises well beyond this product. Enterprise software gets patched because something makes it happen: a vendor pushes an update, a package manager surfaces the upgrade, a change advisory board tracks the version, a compliance scanner flags the drift. Self-hosted AI middleware typically has none of those. A Langflow instance gets stood up on a VM by a data or machine learning team to solve a specific problem, it works, and it inherits no owner. It is not in the configuration management database. It is not in the vulnerability management scope. It does not appear on a software bill of materials because nobody procured it. It simply runs.
Meanwhile the thing it is running has quietly become load-bearing. Low-code AI orchestration went from prototyping convenience to production infrastructure in about two years, and the governance did not follow. That is the actual finding here. The tooling acquired the importance of enterprise infrastructure without acquiring the maintenance obligations that normally arrive alongside it.
Three limitations should temper any reading of this. First, the 360 figure is exploitation attempts observed by one vendor against its own canary systems in one country. It is not a count of confirmed compromises and not a count of affected organisations. Honeypots measure attacker interest, which is a leading indicator of risk rather than a measure of damage.
Second, Condon says there are no known public proof-of-concept exploits for CVE-2026-0768. That is a meaningful cap on how fast this can scale. The March CVE-2026-33017 wave arrived within about a day of disclosure, and the CVE-2026-9198 activity followed public PoCs becoming available; the absence of one here points to a narrower set of actors with their own capability rather than commodity mass scanning. That can change without warning, and usually does.
Third, none of the reporting establishes how many real Langflow instances were compromised, or how many are exposed at all. The population size is unknown. Treat this as a reason to check your own estate, not as a basis for estimating anyone else's.
A reverse proxy or VPN in front of the instance removes internet reachability, which is genuinely the difference between exposed and not exposed. It does not remove the underlying flaw, and it does nothing about an attacker already inside the network perimeter or a credential that has already left. Network placement buys time. Upgrading is the fix.
The uncomfortable part of this story is how ordinary it is. No zero day, no sophisticated actor, no supply chain. Just a January disclosure, a September wave, and seven releases of distance in between. The AI stack is accumulating exactly the kind of unowned, credential-rich, internet-facing middleware that the rest of enterprise IT spent two decades learning to inventory. The lesson transferred. The inventory did not.
Check the version reported by the running application or the installed package. CVE-2026-0768 affects Langflow 1.4.2 and earlier. The current release is 1.11.6, which the maintainers say addresses all known flaws. Because the vulnerable range is broad and five other Langflow CVEs were exploited in the wild earlier in 2026, anything materially behind current should be treated as at risk from more than this one issue.
We follow the vulnerabilities, incidents and governance gaps in the infrastructure enterprises are quietly running in production.
Read our Technology coverageOpposition to data centres is not a referendum on AI. It is a cost-allocation dispute — and PJM's capacity auction is the mechanism that turned an abstract argument into a number on 67 million households' bills.
OpenAI's first published benchmarks for its custom inference chip are real, from a public benchmark, and normalised on nameplate TDP rather than measured power. OpenAI disclosed that itself, in a sentence nobody is quoting.
IDC has cut its 2026 PC forecast three times in nine months — from −2.4% to −8.9% to −11.3%. Thirty-two million fewer machines, and the market is worth more money. The revision trail is the story.