# VulnCheck: the agentic secret hunter also came in through Langflow

> VulnCheck's honeypots caught the agentic credential hunter from Microsoft's report entering through an unpatched Langflow server.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident, Attack
- **Published by:** VulnCheck
- **Disclosed:** 2026-11-08
- **CVE:** CVE-2025-3248
- **Affects:** Langflow, Microsoft Entra ID
- **Research by:** Patrick Garrity
- **Primary source:** https://www.vulncheck.com/blog/microsoft-secret-hunter
- **Page:** https://theinjection.dev/items/vulncheck-langflow-agentic-secret-hunter/

VulnCheck canaries recorded the same IP address named in Microsoft's agentic AI report exploiting Langflow through CVE-2025-3248, running 11 scripted stages that dumped environment variables and decrypted stored provider keys.

## What happened

VulnCheck published the finding on November 8, 2026, in a post by Patrick Garrity. Its Canary sensors logged 25 events and 13 distinct requests from 199.19.77.84, the address Microsoft Threat Intelligence named on November 5 as the source of service principal sign-ins that used leaked app credentials. On the canaries, that address arrived through Langflow rather than through GitHub.

## How it works

CVE-2025-3248 lets an unauthenticated caller post Python to Langflow's /api/v1/validate/code endpoint, where a decorator runs the code as Langflow compiles it for validation. The operator wrapped all 11 stages in one payload and returned stolen data inside an exception tagged |RAISE|, because the vulnerable endpoint copies exception text into the HTTP response. No payload contacted attacker infrastructure, downloaded a file or wrote one, so the session produced no outbound traffic to block.

## Who is affected

Langflow instances reachable from the internet and still unpatched against CVE-2025-3248 are exposed. VulnCheck's canaries were hit in Great Britain, Sweden and Brazil. On the cloud identity side of the same campaign, Todyl counts at least 27 affected organizations and Huntress saw Azure tokens obtained in four customer tenants.

## What to do

Take Langflow off the public internet, patch it, and place it behind authentication or a VPN. Treat every key inside an exposed instance as compromised: rotate provider keys first, then the Langflow secret key. Hunt for behaviour rather than addresses, such as bursts of large validate/code POSTs and request bodies containing @exec(.

## Quick facts

- **Entry point:** Langflow /api/v1/validate/code, CVE-2025-3248, on CISA KEV since May 2025
- **Session:** 11 stages in 36 minutes, 10 of them sent twice
- **Source address:** 199.19.77.84, the credential abuse IP in Microsoft's report
- **Canaries hit:** Great Britain, Sweden and Brazil
- **Key decryption:** Four approaches tried, success in about 80 seconds
- **Exfiltration:** Data returned in the HTTP response, no attacker server contacted
- **Found by:** Patrick Garrity, VulnCheck

## Questions

### Is my Langflow server affected by this attack?

Langflow servers exposed to the internet without the CVE-2025-3248 patch are the ones at risk. VulnCheck observed the operator reaching the flaw at /api/v1/validate/code with no authentication at all. Instances behind a VPN or an authenticating proxy were not reachable in the sessions VulnCheck recorded. Check whether that endpoint answers unauthenticated requests, then patch or remove public access.

### How is this different from Microsoft's November 5 report on agentic AI and exposed secrets?

Microsoft Threat Intelligence described the operator finding secrets through GitHub searches, then signing in to Azure as a service principal. VulnCheck's canaries recorded the same IP address taking a different route, exploiting an unpatched Langflow server to read credentials directly off the host. Same attacker address, different entry door, and no GitHub step involved in the canary sessions.

### Which credentials should I rotate after exposing a Langflow instance?

Treat every secret stored in or reachable from the Langflow host as compromised. VulnCheck advises rotating AI provider keys first, because the operator searched logs and saved flows for provider key patterns and decrypted the stored variables table. Rotate the Langflow secret key afterwards, since doing it first would leave the older provider keys exposed.

### Can blocking the published IP addresses stop this operator?

Blocking 199.19.77.84 on its own will not hold. VulnCheck saw related Langflow and Azure identity activity from a separate address, 179.43.191.82, which it does not attribute to the same operator. VulnCheck recommends hunting for behaviour instead: bursts of large POST requests to validate/code, and request bodies containing @exec(. Attacker infrastructure changes faster than attacker technique.

## Sources

1. [VulnCheck Research](https://www.vulncheck.com/blog/microsoft-secret-hunter)
2. [Microsoft Report](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)