CVE-2026-5027: Langflow RCE Actively Exploited
A critical unpatched path traversal vulnerability (CVE-2026-5027, CVSS 8.8) in Langflow, a widely-used open-source AI application builder, is being actively exploited in the wild to achieve unauthenticated remote code execution. Because Langflow enables auto-login by default, attackers require no credentials to reach the vulnerable endpoint and can exploit it with a single HTTP request. With approximately 7,000 publicly exposed Langflow instances and nation-state actors already targeting related Langflow flaws, the risk to AI development infrastructure is severe.