Threat actors are exploiting CVE-2026-0768, a critical RCE flaw in Langflow that can allow unauthenticated code execution as root through the custom component editor. VulnCheck says the attacks are being used for reconnaissance and credential harvesting, with activity seen mainly from Russia and more than 360 attempts detected against its UK canaries. #CVE-2026-0768 #Langflow #VulnCheck
Keypoints
- CVE-2026-0768 is a critical remote code execution flaw in Langflow.
- The bug affects versions up to Langflow 1.4.2.
- Attackers can execute arbitrary Python code as root without authentication.
- VulnCheck observed reconnaissance and credential-harvesting activity tied to the exploitation.
- More than 360 exploitation attempts were seen against VulnCheck canaries in the UK, with activity mainly from Russia.
Read More: https://www.securityweek.com/hackers-start-exploiting-critical-langflow-vulnerability/