Analysis
Attackers are actively exploiting a critical, unauthenticated remote-code-execution vulnerability in Langflow, the open-source visual builder widely used to construct AI agents and retrieval-augmented-generation applications, The Hacker News reported. The flaw, tracked as CVE-2026-0768, carries a 9.8 out of 10 CVSS severity score and lives in the code validator inside Langflow's custom-component editor -- meaning an attacker needs no credentials to run arbitrary Python code on a vulnerable server.
The vulnerability was first disclosed in January 2026 by Trend Micro's Zero Day Initiative, but researchers say this is the first wave of confirmed real-world exploitation, with more than 50 detections logged on canary systems in the UK. The attack traffic has come primarily from Russia, and one campaign used Python scripts containing Chinese-language comments that appear to hunt specifically for Langflow instances already backdoored by other attackers -- suggesting multiple, unrelated threat actors are now racing to claim the same vulnerable population of servers.
Not Just a Crash -- Credential Harvesting Infrastructure
Beyond code execution, attackers observed in the campaign are reading Langflow's local secret-key file at a known filesystem path, checking SSH access configuration, and measuring the size of .bash_history files -- reconnaissance consistent with harvesting API keys, cloud credentials, and session tokens rather than simple defacement or crypto-mining. Researchers say this is Langflow's 12th exploited CVE, according to a separate report, and argue the pattern confirms popular AI-agent frameworks have effectively become credential-harvesting infrastructure for attackers targeting the broader AI supply chain -- a company's Langflow instance is now a target not because of what it does, but because of what secrets it touches.
Langflow, founded in 2020 by Rodrigo Nader and Gabriel Almeida as a self-funded consultancy before pivoting to the open-source Langflow tool, was acquired by DataStax in April 2024; DataStax itself is now being acquired by IBM, meaning IBM is inheriting a widely deployed AI tool with a growing exploited-CVE count at the exact moment enterprises are racing to deploy agentic AI. Langflow competes for the same low-code AI-workflow niche as n8n -- a more mature, business-automation-rooted platform with 2019 origins -- along with Flowise and a wave of newer agent-builder startups; Pulse has tracked the security gap opening up around agentic AI tooling before, as vendors race to ship agent capabilities faster than they can secure them.
For enterprise buyers and the VCs backing agentic-AI infrastructure startups, a 12th exploited CVE in one open-source framework is a genuine diligence red flag, not background noise -- security reviews of any AI-agent tooling vendor now need to specifically ask about code-execution surface area in custom-component or plugin systems, since that's exactly where Langflow's flaws keep recurring.
The counterweight is that Langflow's exposure is partly a function of its popularity and open-source distribution model, not unique recklessness -- widely deployed open tools accumulate CVEs simply because more researchers and attackers are looking at the code, and Trend Micro's own ZDI is the one that originally found and responsibly disclosed this bug back in January. The real failure here isn't Langflow shipping a flaw; it's the population of production deployments that still haven't patched an RCE disclosed eight months ago.
Any team running Langflow -- or evaluating an agent-builder vendor without a clear CVE-response track record -- should treat an unpatched eight-month-old 9.8-severity RCE as the baseline question to ask before the next one.
