Security1 hOctober 12, 2026, 17:01

Langflow CVE-2026-0768: unauthenticated code execution in AI workflow builder

Langflow, an AI workflow builder, has a critical CVE-2026-0768 flaw rated 9.8 that lets unauthenticated requests reach Python code evaluation with the process's privileges. After proof-of-concept material circulated, detection counts jumped from dozens to several hundred, mostly from Russian infrastructure.

DEV Community

Open source

CVE-2026-0768 in Langflow is rated 9.8 on the CVSS scale
Unauthenticated attackers execute Python code as the Langflow process
Detections rose from dozens to several hundred after PoC release
Attackers target API keys, database passwords and service tokens

#Langflow

Langflow CVE-2026-0768 with CVSS 9.8 is under active exploitation

Security

Langflow CVE-2026-12944: Scanner Blocklist Gap Leads to Root Code Execution

Security

CVE-2026-7273 in Zyxel GS1900 switches allows unauthenticated OS command execution

Security

Langflow CVE-2026-0768: unauthenticated code execution in AI workflow builder

Langflow CVE-2026-0768 with CVSS 9.8 is under active exploitation

Langflow CVE-2026-12944: Scanner Blocklist Gap Leads to Root Code Execution

CVE-2026-7273 in Zyxel GS1900 switches allows unauthenticated OS command execution

CVE-2026-17633: Authenticated RCE in Langflow OSS via /api/v1/custom_component