Executive Summary
VulnCheck sees exploitation of Langflow CVE-2026-0768 (root Python execution) and a critical Ruby on Rails flaw in credential probing and C2 activity.
What Happened
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck. The vulnerabilities in question are listed below - CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user. CVE-2026-66066 aka
Affected Products
- Langflow
- Ruby on Rails
Vulnerability / Attack Technique
Exploitation of AI workflow and web frameworks
Technical Mechanism
Unauthenticated code execution in Langflow.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Attackers probe AI tools for stored credentials.
Recommended Controls
- Update Langflow and Rails
- Rotate credentials in exposed Langflow instances
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/attackers-exploit-critical-langflow-and.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.