A critical path traversal vulnerability in Langflow, a widely used open-source low-code platform for building AI-powered applications, is now being actively exploited in the wild.
Tracked as CVE-2026-5027 with a CVSS score of 8.8, the flaw enables attackers to write files to arbitrary locations on the filesystem and achieve remote code execution without requiring valid credentials.
CVE-2026-5027 resides in Langflow’s POST /api/v2/files endpoint, where the filename parameter from multipart form data is not properly sanitized.
Critical Langflow Vulnerability Exploited
This allows an attacker to inject path traversal sequences such as '../' to navigate outside the intended upload directory and write files anywhere on the underlying filesystem.
The attack surface is significantly widened by Langflow’s default configuration: the platform enables unauthenticated auto-login out of the box, meaning a single unauthenticated HTTP request is enough to obtain a valid session token.
The vulnerability was originally discovered and reported by Tenable Network Security, which made three disclosure attempts to the vendor beginning January 20, 2026, before publicly disclosing the flaw on March 27, 2026, after receiving no response.
The MITRE ATT&CK framework maps this issue to technique T1006 (Direct Volume Access / Path Traversal). Currently, no official patch or vendor-confirmed fix exists for this vulnerability.
On June 8, 2026, VulnCheck added CVE-2026-5027 to its Known Exploited Vulnerabilities (KEV) list after its Canary sensors detected first-time in-the-wild exploitation.
Observed attack activity involved the successful use of path traversal sequences to write what appear to be test files on victim systems a common precursor to staging more destructive payloads.
Caitlin Condon stated that a Censys query conducted by the VulnCheck team identified approximately 7,000 Langflow instances publicly exposed on the internet, with the heaviest concentration located in North America.
Several other vulnerabilities in the platform have been actively exploited this year, including CVE-2026-0770, CVE-2026-21445, and CVE-2026-33017, the latter of which was exploited within just 20 hours of its public disclosure.
Additionally, CVE-2025-34291 a chained RCE vulnerability combining overly permissive CORS settings, missing CSRF protections, and a code-execution endpoint was first disclosed in December 2025 and exploited in early 2026.
Threat intelligence linked its exploitation to the Iranian state-sponsored group MuddyWater, confirming that Langflow is actively targeted by sophisticated, nation-state-level adversaries rather than merely opportunistic scanners.
Mitigation
Since no official patch exists for CVE-2026-5027, security teams should take the following immediate steps:
- Restrict public exposure — Remove Langflow instances from public internet access or place them behind a VPN or zero-trust gateway
- Deploy a Web Application Firewall (WAF) — Use WAF rules to detect and block path traversal sequences (
../) in file upload requests - Upgrade where possible — Check the official Langflow GitHub repository for any available patches or mitigation guidance
Organizations running Langflow in internet-facing or production AI development environments should treat this as a high-priority incident and act immediately given the confirmed exploitation activity and lack of an available fix.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
