Langflow Zero-Day CVE-2026-0768: AI Apps at Risk

Published September 10, 2026 - Cambridge, MA. CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in the open-source Langflow AI application framework, is being actively exploited in the wild. The vulnerability was disclosed and patched in late August 2026 in Langflow version 1.42.3; all earlier versions are vulnerable. CISA added the CVE to the Known Exploited Vulnerabilities (KEV) catalog on August 28, 2026, mandating federal civilian agencies to patch within 14 days.

Vulnerability data last verified September 10, 2026 from the Boston Institute of Analytics weekly cybersecurity roundup (September 5, 2026), the official Langflow GitHub security advisories, and the CISA Known Exploited Vulnerabilities catalog.

Quick Answer

CVE-2026-0768 is a critical unauthenticated RCE in Langflow versions earlier than 1.42.3, being actively exploited for cryptomining, backdoor deployment, and credential harvesting. The patch is in version 1.42.3, released late August 2026. CISA added it to the KEV catalog on August 28, 2026. Organizations running Langflow must upgrade immediately, audit logs for prior exploitation, rotate accessible secrets, and block direct internet exposure.

What Is Langflow

Langflow is an open-source, low-code framework for building AI applications, particularly those that orchestrate large language models, retrieval-augmented generation pipelines, and agentic workflows. It is widely used by enterprises and developers building production AI applications on top of foundation models from OpenAI, Anthropic, Google, and open-source providers. The framework has gained significant adoption in 2025-2026 as enterprises move from prototype AI demos to production AI deployments.

The customer base includes Fortune 500 enterprises, mid-market companies, and academic institutions. The vulnerability affects all of these deployments running unpatched Langflow instances exposed to the internet or to internal networks. The unauthenticated RCE means an attacker does not need valid credentials or any prior access - only network reachability to the Langflow server.

Exploitation in the Wild

Threat actors began exploiting CVE-2026-0768 in the days following the public disclosure in August 2026 (Boston Institute of Analytics, September 5, 2026). Exploitation observed in the wild includes cryptominer deployment (XMRig and similar Monero miners), establishment of persistent backdoors via web shells, credential harvesting from the host and adjacent services, and lateral movement to cloud metadata services for cloud-account takeover.

The vulnerability is being scanned for at internet scale by multiple threat actor groups, and honeypot data shows thousands of exploit attempts per day against exposed Langflow instances. CISA added CVE-2026-0768 to the Known Exploited Vulnerabilities (KEV) catalog on August 28, 2026, mandating federal civilian agencies to patch within 14 days. The KEV listing also triggers reporting requirements for federal contractors and serves as a strong signal to private-sector organizations to prioritize patching.

The Patch and Upgrade Path

The patch is in Langflow version 1.42.3, released in late August 2026 (Boston Institute of Analytics, September 5, 2026). All deployments running Langflow versions earlier than 1.42.3 are vulnerable. The patch addresses the unauthenticated RCE by adding authentication requirements to the affected endpoint and sanitizing user-supplied input that was being evaluated in an unsafe context.

Organizations running Langflow in production should upgrade to 1.42.3 or later immediately, and should also audit logs for any signs of exploitation prior to the patch deployment. The Langflow project has published a security advisory with upgrade instructions on its GitHub repository and official documentation site.

Broader AI Security Pattern

CVE-2026-0768 is the highest-profile AI-infrastructure vulnerability of 2026, but it is part of a broader pattern. Earlier in 2026, vulnerabilities were disclosed in Chroma (vector database), LlamaIndex (RAG framework), Haystack (NLP framework), and several other AI development tools. The pattern reflects the rapid growth of AI infrastructure without the same security maturity that traditional web frameworks have developed over 20+ years.

AI development frameworks are often deployed with default configurations that expose them to the internet, and developers building AI applications may not have the same security training as traditional web developers. The Langflow vulnerability is likely to drive enterprise procurement policies that require AI infrastructure vendors to demonstrate security maturity equivalent to traditional enterprise software, including SOC 2 Type II attestations, third-party penetration testing, and a published vulnerability-disclosure policy with response SLAs.

Immediate Remediation Steps

Organizations running Langflow in production should immediately: (1) identify all Langflow instances in their environment via infrastructure-as-code search and cloud configuration audit; (2) upgrade all instances to version 1.42.3 or later within 24 hours; (3) audit logs for the affected endpoint for any unauthenticated requests that may indicate prior exploitation; (4) rotate any secrets that were accessible from the Langflow host, including cloud credentials, API keys, and database passwords; (5) deploy network-level controls to prevent direct internet exposure of Langflow instances, including firewall rules, authentication proxies, and zero-trust network access; (6) monitor for outbound network traffic from Langflow hosts to known cryptominer pools and C2 infrastructure; and (7) report any confirmed exploitation to CISA and the FBI's Internet Crime Complaint Center (IC3) as required for federal contractors and recommended for private sector victims.

Verify current patch status and exploitation activity on the official CISA Known Exploited Vulnerabilities catalog at cisa.gov/known-exploited-vulnerabilities-catalog and the Langflow GitHub repository security advisories.