CVE-2026-0768

Name of the Vulnerable Software and Affected Versions Langflow versions 1.4.2 and earlier

Description An unauthenticated remote code execution flaw exists in the custom component editor's code validation logic. The issue occurs because the application fails to properly validate user-supplied strings before using them to execute Python code. An attacker can exploit this by sending malicious content to the /api/v1/validate endpoint via the code parameter, allowing for arbitrary code execution in the context of root.

Real-world exploitation has been observed, with over 360 attempts detected by honeypots. Attackers are using this flaw to perform system reconnaissance and harvest sensitive credentials, specifically targeting environment variables such as OPENAI API*, AWS ACCESS*, AWS SECRET*, and LANGFLOW SUPERUSER, as well as accessing /root/.cache/langflow/secret key, .ssh directories, and .bash history files.

Recommendations Update Langflow to version 1.11.6. As a temporary workaround, restrict network access to the /api/v1/validate endpoint to trusted IP addresses only. Remove unnecessary internet exposure by placing authentication or access controls in front of management interfaces. Rotate all potentially exposed credentials, including OpenAI API keys, AWS access keys, and administrative secrets. Audit SSH keys and shell history for unauthorized access.