Attackers are exploiting a critical Langflow vulnerability to steal credentials and cloud keys, according to BleepingComputer. The flaw, tracked as CVE-2026-0768, is an unauthenticated remote code execution issue in Langflow, an open-source Python-based low-code framework used to build AI applications, agents, chatbots, and retrieval-augmented generation systems. BleepingComputer reports that the bug sits in the code validator of Langflow’s custom component editor. The issue affects Langflow versions 1.4.2 and earlier and allows arbitrary code execution without authentication with root privileges. The technical description cited by BleepingComputer says the vulnerable path involves improper validation of a user-supplied code parameter before it is used to execute Python code through the validate endpoint. The exploitation activity was detected by threat-intelligence company VulnCheck on honeypots in the U.K., according to the report. VulnCheck initially saw at least 50 exploitation attempts over the weekend, with attack traffic primarily originating from Russia. BleepingComputer quotes Caitlin Condon, VulnCheck’s lead security researcher, as saying the activity later intensified, reaching 360 observed attacks “as of today.” The objective appears to be credential collection after initial access. BleepingComputer says the attacker performed reconnaissance and queried environment variables that could expose Langflow administrative credentials, superuser authentication keys, AWS secrets, and OpenAI API keys. The reported requests also checked for Langflow’s secret key file, SSH access, and bash history size. That target set matters because Langflow deployments often sit close to the credentials needed to connect AI workflows with external models, databases, APIs, and cloud services. A compromised Langflow instance may therefore expose more than the application itself if operators stored OpenAI keys, AWS access keys, or other secrets in environment variables accessible to the service. The flaw was disclosed in January, BleepingComputer reports. VulnCheck’s Condon said there are no known public proof-of-concept exploits for CVE-2026-0768, which makes the observed exploitation notable: according to the account provided, attackers are still able to hit vulnerable systems without a widely known public exploit being available. The report places CVE-2026-0768 in a broader pattern of Langflow exploitation this year. BleepingComputer says attackers previously exploited CVE-2026-33017, a critical code-injection flaw, within about a day of disclosure to run Python scripts and harvest .ENV and database files. The outlet also cites later exploitation of CVE-2026-5027, CVE-2026-55255, CVE-2026-0770, and CVE-2026-9198, with impacts ranging from arbitrary file writes to access to other users’ AI workflows, sensitive-data theft, second-stage implants, malware deployment, and attempts to extract cloud credentials, environment variables, and container metadata. BleepingComputer says Langflow users should upgrade to the latest available version, 1.11.6, which it reports addresses all known flaws in the tool. For teams running Langflow, the immediate operational question is not only whether the vulnerable version is still reachable, but whether any secrets stored in or reachable from the runtime have already been queried and need rotation. Who benefits: Defenders get a concrete patch target and a clear list of secrets to inspect: Langflow superuser credentials, OpenAI API keys, AWS access keys, SSH access, bash history, and Langflow secret-key material. Teams already on current Langflow versions are less exposed to the specific flaw described in the report. Who's exposed: Organizations running Langflow 1.4.2 or earlier are the clearest risk group, especially if the service is reachable to attackers. Deployments that store cloud and AI-provider credentials in environment variables may face broader credential-theft risk.