Langflow's Unauthenticated File-Write Flaw Is Being Exploited — Patch Dropped 73 Days Ago

A path traversal vulnerability in Langflow has been under active exploitation for weeks. The fix has existed since April 15. That gap tells you most of what you need to know about how AI tooling gets operationalized in the enterprise.

The flaw, tracked as CVE-2026-5027 with a CVSS score of 8.8, lives in the POST /api/v2/files endpoint. Langflow fails to sanitize the filename parameter inside multipart form data, so an attacker can inject ../ sequences and drop files wherever the process has write permissions on the host filesystem. Arbitrary file write. Full stop.

That would be bad enough on its own. What makes it worse is Langflow's default posture: auto-login is enabled out of the box, meaning any unauthenticated user holding a valid session token can reach the vulnerable endpoint without supplying credentials. One HTTP request. No account required. Researchers at EQST Lab demonstrated a working proof-of-concept showing escalation from file write to remote code execution in environments running default settings — which, based on roughly 7,000 internet-exposed instances counted by the Cloud Security Alliance, describes a lot of deployments.

To be precise about the RCE path: arbitrary file write becomes code execution when an attacker can overwrite application files, inject content into startup scripts, or plant payloads in shell initialization files. The blast radius depends on the privileges the Langflow process runs under — and low-code AI platforms deployed for rapid prototyping are not famous for running as least-privileged service accounts.

VulnCheck confirmed active exploitation, with observed attempts to drop files onto vulnerable hosts. Iranian state-sponsored group MuddyWater has been linked to exploitation activity. Public proof-of-concept code is circulating, which lowers the bar considerably for opportunistic attackers who have no particular interest in AI infrastructure beyond the fact that it's exposed and unpatched.

Affected versions run up to and including 1.8.0. Version 1.9.0 contains the fix; the current release is 1.10.0.

Would MFA have helped here? Partially. Enabling authentication in Langflow's settings would eliminate the unauthenticated access vector, making exploitation meaningfully harder — though the underlying path traversal in the file upload handler still needs the code-level patch to be fully remediated. Disabling auto-login is a mitigation, not a substitute for upgrading.

The broader pattern is the real story. Teams stood up Langflow, Flowise, n8n, and similar low-code workflow tools throughout 2025 to prototype agent pipelines fast. They ran with default auth settings. They put them on public IPs for stakeholder demos. Nobody owned patching them afterward. That's not a Langflow problem specifically — it's what happens when developer tooling gets promoted to production infrastructure without the accompanying security review cycle.

This is the second critical Langflow RCE to see active exploitation this year. A severe RCE in Flowise's MCP implementation surfaced recently through crafted configurations. The pattern across AI orchestration platforms is consistent enough now to treat it as a category risk, not a string of coincidences.