Langflow Path Traversal Under Active Exploitation, No Patch Available

A path traversal flaw in Langflow, the open-source low-code platform for building LLM-powered apps, is being exploited in the wild. There is no patch.

The bug is tracked as CVE-2026-5027, with a CVSS score of 8.8. It sits in an unauthenticated POST endpoint that fails to normalize user-supplied paths, letting an attacker write files to arbitrary locations on the host. That primitive is a short walk from remote code execution — drop a payload into a directory the Langflow process or its scheduler reads, and you have execution.

Exploitation was flagged by VulnCheck, which observed scanning and successful writes against exposed instances. At time of writing, the maintainer advisory and a fixed release are still pending. Attribution is thin. The activity appears opportunistic rather than targeted, with telemetry consistent with broad internet-wide scanning rather than a specific operator cluster.

This is not the first time Langflow has shown up in exploitation feeds. Earlier this year, CVE-2025-3248, an unauthenticated RCE in the same product, was added to CISA's Known Exploited Vulnerabilities catalog after being abused by what researchers assessed with medium confidence to be a botnet operator deploying the Flodrix payload. Some of the infrastructure used in that earlier campaign reportedly overlapped with commodity crypto-mining and DDoS-for-hire tooling, though no nation-state nexus was ever established.

The pattern matters. Langflow instances are often stood up by data scientists and ML engineers, exposed to the internet for demo purposes, and forgotten. That makes the install base a soft target population — high count, low patch cadence, frequently running with broad filesystem and network permissions because the workflows they orchestrate need it.

What to do until a fix ships:

• Take Langflow off the public internet. Put it behind a VPN or an authenticated reverse proxy with allow-listing.
• Audit /tmp, the Langflow working directory, and any flow-import paths for unexpected files written in the last 30 days.
• Run the process as an unprivileged user in a container with a read-only root filesystem where possible.
• Pull egress logs. Post-exploitation in the earlier Flodrix campaign included outbound connections to staging hosts over non-standard ports.

For defenders running detections, the indicators from the earlier Langflow campaigns are a reasonable starting baseline, but operators rotate infrastructure quickly and the current activity may not reuse them.

This one is worth monitoring closely. Unauthenticated file write on an AI orchestration platform is exactly the kind of capability that gets folded into broader access-broker toolkits once a working exploit circulates. Capability is here. Intent will follow whoever picks it up.