Langflow Path Traversal Flaw CVE-2026-5027 Hits CISA's Exploited List
An unauthenticated write-anywhere bug in the open-source AI builder is being abused in the wild, per VulnCheck telemetry, raising fresh questions for federal users bound by BOD 22-01 patch deadlines.
A high-severity path traversal vulnerability in Langflow, the open-source low-code framework for building LLM applications, is under active exploitation.
The flaw is tracked as CVE-2026-5027 and carries a CVSS v3.1 base score of 8.8. Researchers at VulnCheck flagged the in-the-wild activity.
The defect sits in the POST /api/v2/ file-upload handler. An unauthenticated attacker can supply a crafted path and write files to arbitrary locations on the host. Chained with Langflow's component-loading behavior, that primitive is sufficient for remote code execution.
That is the operative risk. Write-anywhere plus a process that reads what you wrote equals RCE.
The attack surface is meaningful. Langflow deployments often run with broad filesystem permissions inside containers that also hold API keys for downstream model providers, vector databases, and orchestration tooling. A successful write can drop a malicious flow definition, overwrite a startup script, or stage a webshell — depending on how the instance was provisioned.
Operators should treat any internet-exposed Langflow instance as potentially compromised pending forensic review.
The project's maintainers have shipped a patched release. Users should upgrade immediately and consult the advisory on the Langflow GitHub repository for the fixed version string and indicators. Air-gapped or self-hosted users running older builds behind reverse proxies are not insulated; the vulnerable endpoint is reachable without authentication by default.
Regulatory posture. Federal civilian agencies should watch CISA's Known Exploited Vulnerabilities Catalog for an addition. Inclusion would trigger the remediation timeline set out in Binding Operational Directive 22-01, which requires patching within the deadline specified at the time of listing. Contractors operating Langflow inside FedRAMP-authorized boundaries should review change-control obligations under the moderate baseline before deploying the hotfix in production.
Private-sector reporting obligations may also apply. Public companies that determine the exploitation of an unpatched Langflow instance to be a material cybersecurity incident remain subject to the four-business-day disclosure requirement under Item 1.05 of Form 8-K, finalized by the SEC in July 2023 and effective for most registrants since December 18, 2023. Critical-infrastructure entities should track CIRCIA implementation; the final rule from CISA is still pending after the proposed rulemaking published April 4, 2024, and the associated comment period closed July 3, 2024.
VulnCheck has not attributed the exploitation activity to a named actor. Indicators released so far show opportunistic scanning consistent with mass-exploitation patterns seen against earlier Langflow CVEs.
Patch, then hunt.
