AI Threat Alert
CVE-2026-0768
UNKNOWNCVE-2026-0768 is an unauthenticated remote code execution vulnerability in Langflow that grants attackers a root shell with a single HTTP request — no credentials needed. Any internet-exposed Langflow instance must be treated as fully compromised until isolated and patched. Immediately firewall all external access to Langflow, rotate all LLM API keys accessible from the host, and check logs for exploitation of the /validate endpoint.
Affected Systems
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| langflow | pip | — | No patch |
Do you use langflow? You're affected.
Severity & Risk
Recommended Action
- 1) IMMEDIATE — Block all external network access to Langflow ports (default 7860) via firewall or security group rules; this is non-negotiable until patched. 2) PATCH — Update Langflow to the version that addresses ZDI-26-034 once vendor confirms fix availability; track the ZDI advisory for patch status. 3) DETECT — Query web/app server logs for POST requests to any /validate endpoint with code or script parameters; alert on outbound connections spawned by the Langflow process. 4) ROTATE CREDENTIALS — Assume all LLM API keys, database credentials, and secrets accessible from the Langflow host are compromised; revoke and reissue immediately. 5) HARDEN DEPLOYMENT — Langflow must never run as root; enforce container non-root user, read-only filesystem where possible, and network egress controls.
Classification
Compliance Impact
This CVE is relevant to:
Technical Details
NVD Description
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.
Exploitation Scenario
An adversary scans Shodan or Censys for Langflow instances exposed on default port 7860. Upon finding a target, they craft a single POST request to /api/v1/validate embedding a Python reverse shell payload in the code parameter — no authentication step required. Langflow executes the payload as root, yielding an interactive shell in under 30 seconds. The attacker immediately harvests LLM API keys from environment variables, exfiltrates AI workflow YAML definitions exposing proprietary agent logic, and establishes persistence via a modified Langflow component or cron job. Total time from discovery to root shell: under five minutes.