Unauthenticated RCE in Langflow Enables Theft of OpenAI and AWS Credentials

Security researchers have identified a critical vulnerability in Langflow, an open‑source framework used to assemble AI‑driven applications, that allows attackers to execute code on vulnerable servers without any authentication. The flaw, catalogued as CVE‑2026‑0768, has been weaponised by threat actors to harvest sensitive information such as OpenAI API tokens and Amazon Web Services (AWS) access keys.

Langflow provides a visual interface for designing and deploying machine‑learning pipelines, and its popularity has grown among developers seeking rapid prototyping tools. The remote code execution bug stems from insufficient input validation in a component that processes user‑supplied workflow definitions. Because the vulnerability can be triggered over the network without credentials, any exposed instance of the software becomes a potential foothold for malicious actors.

Investigations revealed that attackers are leveraging the flaw to run scripts that scrape configuration files, environment variables, and credential stores. The stolen OpenAI keys enable unrestricted access to large language models, while compromised AWS keys can be used to spin up compute resources, exfiltrate data, or launch further attacks within victim cloud environments. The exploitation chain has been observed in the wild, with multiple reports of unauthorized usage charges and data leakage linked to compromised Langflow deployments.

The discovery was first reported by BleepingComputer, prompting the Langflow maintainers to release an emergency patch that tightens input handling and adds mandatory authentication checks for remote API endpoints. Users are urged to upgrade to the latest version immediately, audit their systems for any signs of abnormal activity, and rotate any credentials that may have been exposed. Security experts also recommend restricting network access to Langflow instances behind firewalls or VPNs to limit exposure.

While the immediate threat has been mitigated through the patch, the incident underscores the broader risks associated with rapidly evolving AI tooling ecosystems. Open‑source projects often move quickly to add features, sometimes at the expense of rigorous security testing. Analysts suggest that developers and organisations should adopt a “defense‑in‑depth” approach, incorporating regular code reviews, dependency scanning, and continuous monitoring of cloud credential usage to guard against similar attacks in the future.