CVE-2026-0768

A critical authenticated remote code execution vulnerability, CVE-2026-105740 (CVSS 9.9), in the open-source AI platform Langflow is being actively exploited by threat actors. The flaw allows any authenticated user to execute arbitrary OS commands on the server via maliciously crafted MCP server configurations using the 'stdio' transport, with no input validation or sandboxing. Previdian recorded 1,423 exploit attempts from 27 unique IP addresses since September 19, 2026, with increased activity starting October 11. Attackers are using stolen credentials or weak passwords to authenticate and then deploy payloads to extract environment variables, execute system commands, and attempt lateral movement. Immediate mitigation includes upgrading to a patched version, disabling auto-login, and restricting access to trusted users.

Threat actors are actively exploiting a critical unauthenticated remote code execution vulnerability, CVE-2026-0768, in Langflow, an open-source AI application framework, to steal sensitive credentials including OpenAI and AWS API keys. The flaw exists in the code validator of Langflow's custom component editor, allowing arbitrary Python code execution with root privileges. Attack activity has been observed on honeypots, primarily originating from Russia, with over 360 exploitation attempts detected. Attackers query environment variables and sensitive files to harvest credentials and maintain persistence.

Threat actors are actively exploiting two critical vulnerabilities, CVE-2026-0768 in Langflow and CVE-2026-66066 (KindaRails2Shell) in Ruby on Rails, to conduct credential probing, remote code execution, and command-and-control activities. Exploitation of CVE-2026-66066 involves uploading a crafted image to read sensitive files, leak environment secrets, and achieve RCE, particularly when libvips is used for image processing. Attackers have targeted canary systems globally, with source traffic traced to Russia and a single IP in France, and C2 infrastructure in Israel. Additional post-exploitation activities include deploying credential harvesters, cryptominers, disabling auditd, and lateral movement.