VulnCheck says it has seen two threat actors use different exploitation techniques against Langflow, with more than 15,000 successful attempts tied to CVE-2026-0769, CVE-2025-3248, and CVE-2026-5027. The open source AI workflow builder is being targeted through more than one weakness at the same time, not one isolated bug.
One path abuses a validation endpoint to inject code; another abuses file upload handling to write files on the server. In both cases, a normal web request becomes host control, so fixing one CVE does not close the whole compromise path if the service stays exposed.
That matters most for internet-facing AI workflow platforms and other low-code builders: the exposure sits in the host and the app layer together, and attackers can come back through a different flaw even after one patch lands. VulnCheck also says hundreds of Langflow hosts are still online and vulnerable, so the problem here is persistent reachability, not a single missed update.