CVE-2026-0768Vulnerability
Reported by 4 independent sources · first reported by Risky Business News · last reported
Last reported yesterday
What the reports say
4 reports, newest first · the exact sentence from each-
Metasploit Wrap Up: Langflow, MongoDB, and More“Together they cover an authentication bypass (CVE-2026-93680), 3 unauthenticated remote code execution paths (CVE-2026-0768, CVE-2026-0769, and CVE-2026-10134), and 2 authenticated code execution flaws (CVE-2026-7873 and CVE-2026-93674), spanning Langflow releases from 1.0.0 thro…”
-
Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts“… brute-force attacks, as well as exploiting other flaws in Flowise (CVE-2026-69255) and Langflow (CVE-2026-55255, CVE-2026-9198, and CVE-2026-0768).”
-
Cyber Brief 26-10 - September 2026“Langflow's unauthenticated RCE flaw CVE-2026-0768 exploited in the wild”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“This one is CVE-2026-0768, which never received a patch.”
Indicators reported together
named in the same reports- docs.metasploit[.]comin 1 report
- zet[.]netin 1 report
- www.virtualizor[.]comin 1 report
- eldomador.bsky[.]socialin 1 report
- infosec[.]exchangein 1 report
- 146.70.211[.]112in 1 report
- 192.255.229[.]92in 1 report
Copy these 7 indicators · defanged
Also named with it: CVE-2026-82329, CVE-2026-87491, CVE-2026-55255, CVE-2026-9198, CVE-2026-65660, CVE-2026-83548, CVE-2026-83549, CVE-2026-19490, CVE-2026-9586, CVE-2026-105740, CVE-2026-69255, CVE-2026-105697, CVE-2026-93674
Thanks — we review every report.