Cases › security breach › LR-2026-0799

Langflow 12th exploited CVE of 2026 fuels credential harvesting campaign

Preliminary Why: 1 report: Forkast · subject to change · 1 independent report

Status: no action reported

Severity moderate

Reported 2 Oct 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Langflow, an AI framework acquired by IBM through DataStax, was the target of a sustained exploitation campaign. The activity centers on CVE-2026-0768, an unauthenticated remote code execution flaw in the platform's code validator, first disclosed as a zero-day on 9 January 2026. Throughout 2026, twelve Langflow CVEs were reported exploited in the wild. VulnCheck recorded over 50 Canary detections on 30 August 2026, rising to more than 360 cumulative detections by 1 September 2026. Researchers documented over 15,000 successful exploitation attempts across three CVEs. Attackers were reported to pursue credential harvesting and cryptomining, and vulnerable internet-exposed hosts were concentrated in the United States. The sources do not state how the campaign ended or what affected parties lost.

What happened

1 · What went wrongA CVSS 9.8 unauthenticated remote code execution flaw in the platform's code validator was exploited, first disclosed as a zero-day on 9 January 2026.

2 · What it reached or didTwelve distinct Langflow CVEs were reported exploited in the wild during 2026.

3 · How it was caughtVulnCheck telemetry recorded over 50 Canary detections on 30 August 2026.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week

AI system attacked or breached
Also23 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Similar incidents

Langflow exploited in 1,423 honeypot attack attempts2026-10-15

Cursor git.exe repo-poisoning zero-day patched without advisory or CVE2026-07-17

All cases of this kind ›

Evidence

No source states: what the AI was doing, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

2026 Twelve distinct Langflow CVEs were exploited in the wild during 2026.
2026-01-09 The flaw CVE-2026-0768 was initially disclosed as a zero-day by the Zero Day Initiative.
2026-08-30 VulnCheck recorded over 50 Canary detections.
2026-09-01 The cumulative detection count rose to more than 360.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-10-02

D inferred by us from the described behaviour, reason shown

Who caught it

an outside party