Lone operator exploited Langflow flaws to steal AI and cloud keys across tenants

Sysdig detailed a financially motivated operator who chained two Langflow vulnerabilities to raid the AI orchestration platform for credentials, part of why CISA just added one of them to its exploited-vulnerabilities catalog. Using a cross-tenant access flaw (CVE-2026-55255), the attacker ran flows belonging to other tenants to steal their large language model provider keys and AWS keys, while a separate unauthenticated code-execution flaw (CVE-2026-33017) took over the host itself. The activity, observed in late June against an internet-exposed Langflow instance, followed a methodical pattern of reconnaissance, flow enumeration, and credential theft. It underscores that AI orchestration platforms concentrate valuable secrets and are increasingly a direct target once left exposed online.

Check

Identify any internet-exposed Langflow instances, confirm they are patched against the recent flaws, restrict them from public access, and review logs for cross-tenant flow access and unexpected outbound connections.

Affected

Organizations running exposed or unpatched Langflow (CVE-2026-55255, CVE-2026-33017); attackers can execute other tenants' flows to steal AI and cloud keys and run code on the host, harvesting concentrated credentials.

Fix

Patch Langflow, keep it off the public internet, rotate any potentially exposed AI provider and cloud keys, apply least privilege and short-lived credentials, and monitor for cross-tenant access and credential-harvesting behavior.