Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
An unpatched Langflow flaw is being actively exploited to enable unauthenticated remote code execution. About 7,000 instances are exposed online, mostly in North America.
Intelligence analysis by GPT-5.4 Mini
The Hacker News reports that CVE-2026-5027 in Langflow, a low-code AI app platform, is under active exploitation. The bug is a path traversal issue in file uploads that can let attackers write files anywhere on disk, and researchers say Langflow's default unauthenticated auto-login makes exploitation easier.
The flaw is like a broken mail slot in a workshop for building AI apps. A stranger can slip in the wrong package and put files where they do not belong, which can help them take over the machine if the door is already left open.
Analysis
What happened
VulnCheck says CVE-2026-5027 in Langflow is being exploited in the wild. The flaw is a path traversal bug in the POST /api/v2/files endpoint: the uploaded filename value is not properly sanitized, so an attacker can use ../ sequences to place files in arbitrary locations on the filesystem.
Why exploitation is easier
According to VulnCheck’s Caitlin Condon, Langflow’s default unauthenticated auto-login means an attacker does not need credentials to reach the vulnerable endpoint. A single unauthenticated request can be enough to get a valid session token, after which exploitation can continue toward remote code execution.
What researchers observed
The article says exploitation so far appears to be focused on writing test files on victim systems, but the underlying impact is broader because arbitrary file writes can be chained into code execution. Tenable, which found the issue, said it tried to contact the project maintainers three times in January and February 2026 and disclosed details on March 27.
Exposure and broader pattern
Censys data cited in the story shows roughly 7,000 Langflow instances exposed on the public internet, with most located in North America. The reporting also places this in a wider wave of attacks against Langflow bugs this year, including CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, and CVE-2025-34291. The last of those was reportedly weaponized by MuddyWater.
The takeaway is that attackers are increasingly going after the software layers used to build and deploy AI apps, not just the apps themselves.
Key points
- CVE-2026-5027 is an unpatched Langflow path traversal flaw with a CVSS score of 8.8.
- The bug affects the `POST /api/v2/files` endpoint and can let attackers write files to arbitrary paths.
- VulnCheck says the flaw is being actively exploited in the wild.
- Langflow's default unauthenticated auto-login makes exploitation possible without credentials.
- Censys data cited in the article shows about 7,000 public Langflow instances, mostly in North America.
If administrators patch or remove exposed Langflow instances quickly, the attack surface can shrink fast. The reporting also suggests researchers and vendors are already identifying and publicizing the issue, which can help defenders find and fix vulnerable systems sooner.
If exposed instances stay unpatched, attackers can keep using the flaw to write files and potentially reach remote code execution. The default unauthenticated access and the large number of public instances make this a practical target for repeated exploitation.
