Original article was published here. 

Attackers are actively exploiting CVE-2026-0768, a critical unauthenticated RCE flaw in Langflow’s code validator, running credential-harvesting operations that pull OpenAI API keys and AWS access straight out of compromised agentic AI infrastructure, with exploitation clocked within roughly 20 hours of disclosure.

Gidi Cohen, CEO and Co Founder, Bonfy Had This To Say:

“Two critical vulnerabilities, one week, and honestly the wildest part isn’t even the exploitation, it’s that one of them got “fixed” and the fix didn’t work.

VulnCheck tested a patched Rails server (8.1.3.1) assuming the hole was closed. It wasn’t. The libvips file-read got blocked, sure, but the actual RCE mechanism underneath it — a Marshal deserialization gadget, still fires with a valid signature. So the patch shut one door and left the house wide open. Worth remembering next time “patched” shows up in a report and everyone exhales.

Then there’s Langflow. CVE-2026-0768 isn’t some clever zero-day, it’s unvalidated input leading straight to root access. Not fancy. But look at what’s sitting next to it once you’re in: superuser flags, OpenAI keys, AWS credentials, SSH access. Attackers are literally querying for LANGFLOW_SUPERUSER and OPENAI_API* by name within hours of exploiting it. That’s not someone poking around and getting lucky. That’s a playbook, because someone already knows exactly what credentials live in these environments.

And this keeps happening. 12 vulnerabilities exploited since 2025, 15,000+ successful hits across just three CVEs. The attackers aren’t smash-and-grab types either — one crew disabled audit logging specifically so nobody could see what they did next before dropping their payload. That’s patience, not luck.

So the real question is pretty simple: do you actually know what’s exposed in your AI stack right now, or would you find out the same way we all just did, from a threat intel report after the fact?”

You have to test and keep testing. Because you can never count on any fix working properly.

Original article was published here.