Langflow AI Platform RCE Flaw Exploited — 7,000 Instances Exposed

A path traversal vulnerability in Langflow, the open-source platform for building AI applications, is being actively exploited to achieve remote code execution on exposed servers. Censys scans identified roughly 7,000 publicly accessible Langflow instances, with the majority located in North America.

CVE-2026-5027 carries a CVSS score of 8.8 and requires no authentication to exploit. Langflow version 1.10.0, released today, patches the flaw.

How the Attack Works

The vulnerability exists in Langflow's file upload API endpoint at /api/v2/files. The endpoint fails to sanitize the filename parameter in multipart form data, allowing attackers to use path traversal sequences (../) to write files anywhere on the filesystem.

The attack chain is straightforward:

1. Langflow enables unauthenticated auto-login by default, so attackers can obtain a valid session token with a single request
2. Using that session, they upload a file with a crafted filename containing traversal sequences
3. The file is written to an arbitrary location—such as dropping a web shell into a publicly accessible directory

Tenable researchers who discovered the flaw attempted to contact Langflow maintainers three times before publicly disclosing details on March 27, 2026. Attackers began exploiting the vulnerability shortly after.

Active Exploitation

Observed exploitation primarily involves attackers writing test files to victim systems—likely reconnaissance to identify vulnerable targets before more destructive payloads. But the capability exists to drop malicious Python code, web shells, or configuration files that achieve persistent access.

This isn't Langflow's first security problem in 2026. Multiple other flaws were exploited earlier this year, including CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, and CVE-2025-34291. The pattern suggests Langflow deployments should be treated as high-risk if exposed to untrusted networks.

Who's Running Langflow

Langflow is a visual, low-code platform for building AI applications, AI agents, and RAG (Retrieval-Augmented Generation) workflows. Users drag and drop components to construct pipelines rather than writing traditional code. It integrates with major AI providers and supports MCP-based workflows.

The platform has gained popularity among developers prototyping AI applications and teams building internal tools. But many deployments appear to be experiments or development instances left exposed without proper access controls.

What to Do

If you run Langflow:

1. Upgrade to version 1.10.0 immediately. The patch is available now.

2. Disable unauthenticated access. The default auto-login configuration is dangerous for any network-accessible deployment.

3. Check for indicators of compromise. Look for unexpected files written outside Langflow's data directories, unusual API requests to /api/v2/files, and any web shells or unfamiliar scripts.

4. Don't expose Langflow to the internet. Development and prototyping tools rarely need public access. Put them behind VPNs or zero-trust access controls.

Why This Matters

The AI development tooling ecosystem is expanding rapidly, with new platforms emerging to help developers build and deploy models faster. But that speed often comes at the cost of security fundamentals like input validation and authentication.

Langflow's situation mirrors what we've seen with other AI/ML infrastructure—tools built for experimentation that end up deployed in production without proper hardening. LiteLLM was recently added to CISA's Known Exploited Vulnerabilities catalog for similar reasons.

For organizations using AI development platforms, the lesson is clear: treat these tools with the same security rigor as any other web application. Default configurations optimized for developer convenience are rarely safe for production or even development environments accessible beyond localhost.