Langflow is the kind of tool that makes AI teams move fast: drag some nodes together, wire up an LLM call, ship a workflow. That same speed has made it a favorite target for attackers who understand that AI orchestration platforms sit on top of credentials, API keys, and database connections. The latest evidence is ugly. VulnCheck canaries have logged 15,000+ successful exploitation attempts against Langflow instances, and separate telemetry from Bitbison shows that 29% of attacker IPs that achieved code execution received every planted environment secret. CISA added the most recent chain, CVE-2026-9198, to its Known Exploited Vulnerabilities catalog on August 4, 2026. If you run Langflow and have not patched since July, you are operating in the dark.
The core problem: Langflow's developer convenience features are exploitable as unauthenticated remote code execution chains, and the fixes have shipped inconsistently.
What CVEs are hitting Langflow and how bad are they?
Langflow has accumulated a string of critical vulnerabilities over the past 18 months, each one exposing a slightly different facet of the same underlying problem. The platform treats code execution as a first-class feature and has repeatedly failed to gate it behind reliable authentication.
The most recent and severe is CVE-2026-9198, a CVSS 9.8 chain that the Cloud Security Alliance documented in an August 2026 research note. It combines two flaws. The first, CVE-2026-9103, lives in the /api/v1/auto_login endpoint, which was designed to streamline local development by automatically issuing a session token. Instead, it minted a SUPERUSER-scoped bearer token to any network caller, no credentials required. The second, CVE-2026-8481, lives in the /api/v1/validate/code endpoint, which passes attacker-supplied Python directly into exec() with zero sandboxing. Chain them together and an attacker needs exactly two HTTP requests to get root-level code execution on your server.
The chain affects Langflow OSS versions 1.0.0 through 1.10.0. IBM disclosed both flaws on July 17, 2026 and shipped version 1.10.1 the same day. A public proof-of-concept began circulating in late July, and CISA confirmed active exploitation by August 4. The current stable release as of this writing is 1.11.2.
Langflow has been hammered by critical CVEs throughout 2025 and 2026:
- CVE-2025-3248 (CVSS 9.8): Missing authentication on
/api/v1/validate/code, added to VulnCheck KEV on April 12, 2025 and CISA KEV on May 5, 2025. This was the first major signal that the code validation endpoint was a live attack surface. - CVE-2026-5027 (CVSS 9.4): Upload path traversal allowing arbitrary file write and remote code execution. VulnCheck added it to KEV on January 23, 2026, CISA followed on May 21, 2026. HackerPosts reported that the fix shipped in langflow-base 0.8.3 and Langflow 1.9.0 but was never tagged in release notes, meaning teams relying on changelogs would have missed it.
- CVE-2026-33017: Unauthenticated RCE via the
build_public_tmpendpoint, which accepts attacker-controlled flow data containing arbitrary Python and passes it toexec(). NVD documents this as distinct from CVE-2025-3248. Fixed in 1.9.0, CISA KEV addition March 25, 2026. - CVE-2026-0768 (CVSS 9.8): The vulnerability The Hacker News flags in its September 1 reporting, a lack of proper input validation enabling arbitrary Python execution as root.
The chart below maps the CISA KEV addition dates and CVSS scores for each critical Langflow CVE over the past 18 months.
The pattern is clear. Every few months a new endpoint or code path in Langflow turns out to be exploitable without authentication, and every time the fix either ships quietly or arrives after attackers have already established persistence.
How are attackers actually using these flaws?
VulnCheck deployed canaries running Langflow 1.6.9 with auto-login enabled and watched what happened. The results, published in their analysis of attacks on the AI stack, show two distinct attacker profiles, both ruthless in their efficiency.
The first attacker gained initial access via CVE-2026-5027, the path traversal file write vulnerability. Over two weeks starting May 20, 2026, they deployed a Python credential harvester, proxy agents, and a SimpleHelp remote access trojan. They ran the credential harvester for 20.49 seconds and exfiltrated harvested credentials to a server at 23.234.98[.]182:9999. They installed cron persistence on May 29. By June 8, they had established IRC command and control to 185.117.74[.]172:6667. This is a credential theft operation designed to harvest everything the Langflow process can see and ship it out fast.
The second attacker used CVE-2025-3248 for initial access, then deployed a proxy agent and established C2 connectivity before spinning up an XMR cryptominer. They disabled auditd to create a forensic blind spot, exploited CVE-2026-0769 to drop additional payloads, and then pivoted to scan for other targets to expand the mining operation.
The chart below traces the credential harvester's timeline from canary deployment through IRC C2 establishment, drawn from VulnCheck's published canary logs.
Bitbison's independent analysis adds sharper numbers on the credential exposure problem. Because Langflow returned command output in validation responses, 29% of attacker IPs that achieved code execution received every planted environment secret. Of 15 attacker sources, 6 exfiltrated a planted OpenAI API key, and all 6 retrieved it from saved flow data using a token from /api/v1/auto_login. None of them even needed to call /api/v1/validate/code. A successful GET /api/v1/flows after auto-login from an untrusted source means every credential embedded in those flow definitions was exposed.
That last point deserves emphasis. If your Langflow workflows contain LLM provider keys, database connection strings, or cloud service account credentials in node configurations, and your instance was reachable without authentication, those credentials should be considered compromised. The attacker does not need to run arbitrary code to steal them. They just need the auto-login token and a GET request.
What does this mean for your AI infrastructure?
The Langflow attack pattern reveals a structural problem with how many teams deploy AI orchestration tools. These platforms are built for developer convenience first and security second. They run code, they store credentials in workflow definitions, and they expose HTTP endpoints that make it easy to test and iterate. That combination is toxic when the instance is internet-facing.
Three consequences stand out for anyone building or running AI pipelines.
Your LLM provider keys are the primary target. Attackers are harvesting OpenAI, Anthropic, and cloud provider credentials that let them spin up infrastructure at your expense or exfiltrate data through your authenticated channels. A compromised Langflow instance is a credential laundering operation.
Flow definitions are a data store. Every credential you have wired into a Langflow workflow is sitting in a database table or JSON file that the platform serves via its API. If an attacker can authenticate as a superuser, and the auto-login flaw lets anyone do that, they can pull every flow definition and every embedded secret with a single GET request. This is the AI equivalent of a .env file exposed on a public web server.
Patch communication has been unreliable. The HackerPosts reporting on CVE-2026-5027 found that the fix shipped in Langflow 1.9.0 but was never labeled in release notes. Security researchers who reported the issue in January and February 2026 heard nothing back. If your team relies on changelogs or semantic versioning to decide when to patch, you may already be running a fixed version without knowing it, or running a vulnerable version because the advisory never reached you.
If you want a broader view of how AI coding tools and agent frameworks are being targeted, our earlier coverage of Langflow RCE turning AI endpoints into miner bait tracks the same pattern from earlier in the year.
What should you do if you are running Langflow?
The guidance is straightforward but the execution is not optional.
Upgrade to 1.11.2 or later. Do not trust release notes or container tags to tell you whether you are patched. Verify the actual running version. Prior Langflow patches have shipped with incomplete fixes, and the CSA research note explicitly warns that verifying runtime behavior is more reliable than trusting the version string.
Set LANGFLOW_AUTO_LOGIN to false. If you cannot upgrade immediately, removing the instance from direct internet exposure and placing it behind an authenticating reverse proxy or VPN is your stopgap. The auto-login feature is the root of the most recent chain and should never be enabled on a production or internet-reachable deployment.
Hunt for compromise in your logs. Search proxy and application logs for unauthenticated calls to /api/v1/auto_login followed by POST requests to /api/v1/validate/code or successful full-data GET /api/v1/flows calls from untrusted sources. The Bitbison detection signal is specific: a request to /api/v1/auto_login followed by an authenticated request to /api/v1/validate/code containing Python that executes through a decorator, default argument, or annotation.
Rotate every credential the Langflow process can see. This includes LLM provider API keys, database credentials, cloud service account keys, and any secrets referenced in workflow configurations. If your instance was internet-facing since early July 2026, treat it as compromised pending log review. Do not assume that because you see no evidence of code execution, your credentials are safe. The auto-login flaw means an attacker could have pulled flow definitions and their embedded secrets without ever running code.
Check for persistence. The VulnCheck canary attacker installed cron entries, proxy agents, and a SimpleHelp RAT. Look for unauthorized cron jobs, modified SSH authorized_keys files, unexpected outbound connections, and deleted-but-running executables. Bitbison notes that two payloads removed their filesystem paths after launch and were recoverable only through /proc.
Rebuild after containment. Do not attempt to clean a compromised Langflow host in place. Rebuild from a known-good image after you have contained the incident, rotated credentials, and confirmed the new instance is running a patched version with auto-login disabled.
The Hacker News also reports that Ruby on Rails CVE-2026-66066 is under simultaneous exploitation, which means your patch window this week may already be split across two critical frameworks. Prioritize based on exposure: an internet-facing Langflow instance with auto-login enabled is the highest-risk asset you can have right now.
The credentials are the payload
The most important shift in how you should think about AI infrastructure security is this: the attackers are after the keys. Langflow is attractive because it concentrates LLM provider keys, database credentials, and cloud service tokens in a single process that runs code and serves an API. Every workflow you build is a credential store, and every unauthenticated endpoint is a door to it. Patch the software, yes, but treat the credentials as the asset and rotate them as if they were already stolen, because in 29% of observed breaches, they already were.
