Critical Langflow flaw is under active attack on 7,000 exposed AI-agent servers

A critical vulnerability in Langflow, the open-source low-code platform for building AI agent applications, is being actively exploited in the wild, with roughly 7,000 publicly exposed instances at risk.

The flaw, CVE-2026-5027 (CVSS 8.8), is a path-traversal bug in Langflow's POST /api/v2/files endpoint, according to a technical write-up from Orca Security. The filename parameter in multipart form data is not sanitized, so an attacker can use "../" traversal sequences to write files outside the intended upload directory and achieve remote code execution. The default configuration makes it worse: Langflow enables unauthenticated auto-login out of the box, meaning a single unauthenticated HTTP request can obtain a valid session token, leaving exploitation trivial.

The activity is confirmed, not theoretical, though its severity so far appears limited. VulnCheck added the flaw to its Known Exploited Vulnerabilities list on June 8, 2026, after its Canary sensors detected what it described as the first in-the-wild exploitation. Orca's analysis notes that the observed attacks have involved honeypots detecting attackers dropping test files onto vulnerable instances — consistent with attackers probing for vulnerable hosts rather than confirmed deeper compromise. Censys scans identified about 7,000 exposed Langflow instances, with the heaviest concentration in North America.

Because the exploitation was first flagged on June 8, this is an unfolding incident rather than breaking news, and operators have had several days to act.

Fixes are available in Langflow 1.10.0, released June 10, or at minimum Langflow 1.9.0 / langflow-base 0.8.3. Because Langflow is widely embedded in agentic AI pipelines that often hold credentials and API keys, any internet-facing instance should be upgraded immediately and inspected for unexpected files.