Critical Langflow flaw exploited to steal OpenAI and AWS keys

Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability (a flaw allowing attackers to run commands on a system without needing a password) in Langflow, an open-source platform for building AI applications. The attackers are stealing sensitive credentials like OpenAI API keys and AWS secrets by executing code through Langflow's custom component editor, with over 360 exploitation attempts detected in just one weekend.