Langflow's Unauthenticated File-Write Flaw Is Being Exploited — Patch Dropped 73 Days Ago
CVE-2026-5027 lets attackers write files to arbitrary paths on exposed servers, and because Langflow ships with login disabled by default, exploitation requires exactly zero credentials.
Key points
- CVE-2026-5027 is a path traversal flaw in Langflow's file upload endpoint, rated CVSS 8.8, with active exploitation confirmed by VulnCheck.
- Langflow ships with auto-login enabled, so reaching the vulnerable endpoint requires no credentials.
- EQST Lab demonstrated escalation from arbitrary file write to remote code execution on default-configured instances.
- Iranian state-sponsored group MuddyWater has been linked to exploitation activity.
- Version 1.9.0, released April 15, contains the fix; upgrade to 1.10.0.
A path traversal vulnerability in Langflow has been under active exploitation for weeks. The fix has existed since April 15. That gap tells you most of what you need to know about how AI tooling gets operationalized in the enterprise.
The flaw, tracked as CVE-2026-5027 with a CVSS score of 8.8, lives in the POST /api/v2/files endpoint. Langflow fails to sanitize the filename parameter inside multipart form data, so an attacker can inject ../ sequences and drop files wherever the process has write permissions on the host filesystem. Arbitrary file write. Full stop.
What makes it worse is Langflow's default posture: auto-login is enabled out of the box, meaning any unauthenticated user holding a valid session token can reach the vulnerable endpoint without supplying credentials. One HTTP request. No account required. Researchers at EQST Lab demonstrated a working proof-of-concept showing escalation from file write to remote code execution on instances running default settings, which describes a lot of the roughly 7,000 internet-exposed instances counted by the Cloud Security Alliance.
The RCE path is worth spelling out. Arbitrary file write becomes code execution when an attacker overwrites application files, injects content into startup scripts, or plants payloads in shell initialization files. The blast radius depends on the privileges the Langflow process runs under, and low-code AI platforms deployed for rapid prototyping are not famous for running as least-privileged service accounts.
VulnCheck confirmed active exploitation, with observed attempts to drop files onto vulnerable hosts. MuddyWater, the Iranian state-sponsored group we first covered on 28 May 2026, has been linked to exploitation activity. Public proof-of-concept code is circulating, which lowers the bar considerably for opportunistic attackers.
Affected versions run up to and including 1.8.4. Version 1.9.0 contains the fix; the current release is 1.10.0.
Should you just disable auto-login and call it done?
No. Enabling authentication eliminates the unauthenticated access vector and makes exploitation meaningfully harder, but the underlying path traversal in the file upload handler still needs the code-level patch. Disabling auto-login is a mitigation, not a substitute for upgrading.
Is this part of a larger pattern?
This is the third story we have run on CVE-2026-5027 since we first reported active exploitation with no patch available on 10 June 2026. The pattern across AI orchestration platforms is consistent enough to treat as a category risk. Teams stood up Langflow, Flowise, and similar low-code workflow tools throughout 2025 to prototype agent pipelines fast, ran them with default auth settings on public IPs for stakeholder demos, and nobody owned patching them afterward. That's not a Langflow problem specifically. An earlier critical Langflow RCE saw active exploitation this year, and researchers have since found a severe RCE in Flowise's MCP implementation through crafted configurations. The tooling category is now a reliable target.
