Langflow Path Traversal: Unauthenticated RCE Actively Exploited

Key Takeaways

• CVE-2026-5027 is a high-severity path traversal vulnerability (CVSS 8.8) in the Langflow AI development platform that allows unauthenticated attackers to write files to arbitrary locations on the server filesystem, enabling remote code execution through well-documented file write exploitation techniques.
• Langflow’s default auto-login configuration eliminates authentication as a practical barrier, meaning exploitation requires no credentials and can be accomplished with a two-step HTTP exchange.
• Approximately 7,000 Langflow instances are publicly accessible on the internet [1], with the heaviest concentration in North America [6], creating a large and accessible attack surface.
• Active in-the-wild exploitation was first detected on June 8, 2026, 73 days after the vulnerability’s public disclosure — underscoring the risk of unpatched AI development infrastructure [2].
• The initial patch for CVE-2026-5027 shipped in Langflow version 1.9.0, released April 15, 2026; organizations should upgrade to the current release (1.10.0 or later) immediately and audit any publicly exposed Langflow deployments for indicators of compromise [5].

Background

Langflow is an open-source, low-code platform for building AI agents, retrieval-augmented generation (RAG) pipelines, and Model Context Protocol (MCP)-based workflows through a drag-and-drop visual interface. Originally developed as an open-source project in 2023, Langflow was acquired by DataStax in 2024 and subsequently became part of IBM’s AI infrastructure portfolio following IBM’s acquisition of DataStax — a lineage IBM acknowledged in its own security guidance for the platform [7]. The project hosts more than 150,000 stars on GitHub [3] and is widely used by enterprise teams and independent developers to prototype and deploy production AI systems. Its appeal lies in the ability to connect large language models to data sources, external APIs, and automation pipelines without requiring extensive coding, which has accelerated its adoption as AI agent development has grown.

This broad adoption also makes Langflow a high-value target. A compromised Langflow instance typically holds API keys for LLM providers, database credentials, credentials for third-party integrations, and sensitive workflow logic that may interact with production data. Attackers who gain access to the server can extract these credentials, manipulate AI agent behavior, or use the compromised host as a pivot point into broader infrastructure. The platform’s role at the intersection of AI workloads and sensitive integrations elevates both the likelihood and the consequence of exploitation.

CVE-2026-5027 is not the first Langflow vulnerability to be actively exploited in 2026. A pattern of high-severity flaws has emerged across the platform’s releases, including CVE-2026-0770 [9] and CVE-2026-21445 [10], as well as CVE-2026-33017, for which the Sysdig Threat Research Team documented exploitation attempts in the wild within twenty hours of the advisory’s publication [4]. This rapid exploitation cadence indicates that Langflow instances are actively monitored by threat actors and that newly published vulnerabilities are weaponized quickly, leaving little time for operators to apply patches before attacks begin.

Security Analysis

Vulnerability Mechanism

CVE-2026-5027 originates in Langflow’s file upload functionality, specifically the POST /api/v2/files endpoint. When a user uploads a file, the endpoint extracts the filename directly from the Content-Disposition header of the multipart form data and passes it verbatim to the platform’s storage service. No sanitization or normalization is applied to the filename before it is written to disk. An attacker can supply a filename containing path traversal sequences — such as ../../etc/cron.d/malicious — and the server will write the uploaded content to the attacker-controlled location outside the intended upload directory [5].

The vulnerability is compounded by Langflow’s default authentication posture. Out of the box, Langflow enables an auto-login feature that allows any HTTP client to obtain a valid session token without providing credentials. This means the attack chain requires no prior foothold: an attacker sends a single unauthenticated request to obtain a session token, then issues the malicious file upload request against the vulnerable endpoint. The entire exploit can be executed with two HTTP calls against any publicly accessible instance [1][2].

Path to Remote Code Execution

While CVE-2026-5027 is categorized as an arbitrary file write vulnerability, security researchers have demonstrated that file write primitives on Linux systems frequently translate to full remote code execution — as is common with this class of vulnerability. Several vectors are available to an attacker who can write files to arbitrary filesystem locations with the privileges of the Langflow backend service. Writing to /etc/cron.d/ allows the attacker to schedule a command — such as a reverse shell — to execute at a future time under the service’s identity. Writing to ~/.ssh/authorized_keys grants persistent SSH access. Overwriting Python modules within Langflow’s import path enables arbitrary code injection into the application itself. In containerized or root-running deployments, these techniques can yield full host compromise [5][6].

According to reporting by BleepingComputer [1], VulnCheck’s canary sensors first detected in-the-wild exploitation on June 8, 2026, observing the successful use of path traversal sequences to write test files on victim systems — activity consistent with reconnaissance and capability verification prior to escalation. This observed pattern is consistent with both targeted operations and systematic opportunistic scanning, as is common in early exploitation of newly public CVEs.

Threat Actor Activity

Threat intelligence has linked exploitation of Langflow vulnerabilities to the Iranian state-sponsored group known as MuddyWater [2]. This group, which has previously been associated with exploitation of internet-exposed management and development infrastructure, has been observed weaponizing Langflow flaws to gain initial access to target networks. Attribution assessments in this context should be treated as intelligence-grade — supporting a working hypothesis rather than a legally definitive determination — but the pattern of targeting is consistent with MuddyWater’s known interest in development and research infrastructure as access vectors.

The involvement of a nation-state-aligned actor in Langflow exploitation is notable because it signals that AI development tooling has entered the same threat landscape as enterprise software products and VPN appliances. Organizations that treat AI development platforms as lower-priority internal tools, and defer patching or exposure management accordingly, face adversaries who do not share that assumption.

Disclosure and Patch Timeline

The vulnerability’s disclosure history highlights a significant gap between discovery, vendor notification, and remediation. Tenable Network Security discovered CVE-2026-5027 and made its first disclosure attempt to the vendor on January 20, 2026. After three disclosure attempts without a complete remediation response, Tenable publicly disclosed the vulnerability on March 27, 2026 [5]. Despite this public disclosure, the initial patch did not ship until Langflow version 1.9.0, released April 15, 2026 — 73 days after the flaw became publicly known and available to any attacker who read the advisory. In-the-wild exploitation was ultimately confirmed on June 8, 2026, after the patch had been available for nearly two months but was not yet widely applied [2][6]. CISA subsequently added CVE-2026-5027 to its Known Exploited Vulnerabilities catalog [8], underscoring the agency’s assessment of active exploitation risk. The patch in Langflow 1.9.0 corrects the filename sanitization logic in the file upload endpoint; the fix is also present in all subsequent releases, including the current version 1.10.0 [2][5].

IBM has also published a security bulletin acknowledging the vulnerability’s impact on Langflow components bundled within IBM products, providing additional remediation guidance for enterprise IBM customers [7].

Recommendations

Immediate Actions

Organizations running any version of Langflow prior to 1.9.0 should treat this as a critical-priority upgrade. Upgrading to version 1.9.0 or later — including the current release, 1.10.0 — resolves the filename sanitization defect and is the authoritative remediation for CVE-2026-5027 [2][6]. Where an immediate upgrade is not operationally feasible, the highest-impact interim control is to remove public internet access to Langflow instances entirely. If Langflow must remain accessible to external users, a Web Application Firewall rule blocking requests to POST /api/v2/files with path traversal sequences in the Content-Disposition header provides a partial mitigation, though path traversal strings can be obfuscated via URL encoding, double encoding, or Unicode normalization variations, making WAF rules an unreliable substitute for patching.

Any organization running Langflow on a publicly accessible host should treat the system as potentially compromised until the audit steps below are completed. Indicators of compromise include unexpected files in cron directories, new SSH authorized keys, unfamiliar Python files in Langflow’s installed package directories, and unexplained outbound network connections from the Langflow host.

Disabling auto-login is a critical configuration hardening step independent of the CVE patch. In the Langflow configuration, LANGFLOW_AUTO_LOGIN=false forces users to authenticate before accessing any endpoint, substantially raising the barrier for exploitation of future vulnerabilities that require an authenticated session. This setting should be treated as a baseline requirement for any production deployment.

Short-Term Mitigations

Within the next thirty days, security teams should conduct an inventory of all Langflow deployments across the organization, including shadow deployments created by development teams without formal IT security review. In many organizations, AI development tools are spun up by individual contributors or small teams experimenting with agents and pipelines, and these informal deployments may lack the patch management and monitoring coverage of formally managed systems. The exposure of approximately 7,000 publicly accessible instances identified by Censys suggests that many deployments lack even basic perimeter controls [1].

Network segmentation should be applied to Langflow deployments such that instances are accessible only to the hosts and users that require them, and not to the general internet or broad internal network segments. Langflow instances that integrate with production data sources or hold credentials for production LLM APIs warrant the same perimeter treatment as any other system with access to sensitive credentials. Monitoring for anomalous file creation activity, unexpected cron jobs, and unusual outbound connections from Langflow hosts should be added to security information and event management (SIEM) alerting rules.

Strategic Considerations

The repeated exploitation of Langflow vulnerabilities across multiple CVEs in 2026 reflects a broader pattern that security leaders should anticipate as AI development tooling matures. Platforms that lower the barrier to building AI systems also lower the barrier to deploying insecure AI infrastructure. Langflow’s default auto-login feature and the pattern of multiple high-severity CVEs in 2026 suggest that security hardening has been secondary to feature development — a pattern common in developer-tooling ecosystems driven by rapid iteration and competitive adoption pressure. Organizations adopting these tools inherit the resulting security debt.

Security governance programs should extend their software inventory and patch management processes to cover AI development platforms explicitly. These tools frequently hold credentials for external LLM APIs, vector databases, and enterprise data sources, giving them a credential footprint comparable to identity and access management systems. They also sit at the entry point of AI workloads, meaning a compromised Langflow instance could be used to alter agent behavior, inject adversarial prompts into automated workflows, or exfiltrate context passed through the pipeline. Procurement and deployment approval processes should evaluate AI development tools against the same security criteria applied to other internet-facing software.

CSA Resource Alignment

CVE-2026-5027 maps directly to several threat categories and control domains within the Cloud Security Alliance’s published frameworks.

Within the MAESTRO framework for agentic AI threat modeling, this vulnerability engages Layer 1 (Infrastructure Security) and Layer 3 (Application Security). At the infrastructure layer, the lack of input validation in the file upload endpoint represents a foundational infrastructure control failure that enables higher-layer impact. At the application layer, the exploitation of the file write primitive to inject code into the agent runtime — through Python module overwrite or workflow file modification — is an application-layer attack with downstream consequence for the AI agent’s behavior and trustworthiness. MAESTRO’s emphasis on securing the infrastructure substrates on which agentic systems operate is directly applicable here.

The AI Controls Matrix (AICM), CSA’s comprehensive framework for AI security governance, addresses the relevant control domains. For organizations deploying Langflow as an AI application provider, AICM controls related to identity and access management (requiring authentication before API access), input validation (sanitizing filenames and other user-supplied parameters at system boundaries), and vulnerability management (patch cadence and exposure monitoring for AI tooling) apply directly to the conditions that made CVE-2026-5027 exploitable. AICM’s shared security responsibility model is also relevant: while the upstream vendor bears responsibility for shipping secure code, the application operator retains responsibility for deployment configuration, including disabling insecure defaults such as auto-login.

CSA’s Zero Trust guidance is directly applicable to the exposure management challenge illustrated by this vulnerability. A Zero Trust posture would require that Langflow instances be accessible only to explicitly authorized identities over verified channels, eliminating the “any internet host can reach the API” condition that allowed unauthenticated exploitation of the auto-login default. Network micro-segmentation, strong identity requirements for API access, and continuous verification of device and user context are controls that would have prevented or substantially constrained the attack chain described here.

Organizations seeking a structured approach to assessing their AI development tool security posture can leverage the CSA STAR (Security Trust Assurance and Risk) program. STAR assessments provide a mechanism for evaluating whether AI platform vendors meet baseline security controls, and can be used both for internal self-assessment and for evaluating third-party AI tooling vendors as part of procurement due diligence.

References

[1] BleepingComputer. “Path traversal flaw in AI dev platform Langflow exploited in attacks.” BleepingComputer, June 2026.

[2] The Hacker News. “Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE.” The Hacker News, June 2026.

[3] Langflow AI. “langflow-ai/langflow.” GitHub, 2026.

[4] Sysdig Threat Research Team. “CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours.” Sysdig, 2026.

[5] Tenable Network Security. “Langflow — Path Traversal Arbitrary File Write via upload_user_file (TRA-2026-26).” Tenable, March 2026.

[6] SecurityWeek. “Hackers Exploit Langflow Vulnerability for Remote Code Execution.” SecurityWeek, June 2026.

[7] IBM. “Security Bulletin: Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint.” IBM Support, 2026.

[8] CISA. “Known Exploited Vulnerabilities Catalog.” Cybersecurity and Infrastructure Security Agency, 2026.

[9] National Vulnerability Database. “CVE-2026-0770.” NIST, 2026.

[10] National Vulnerability Database. “CVE-2026-21445.” NIST, 2026.