Langflow Bug Turns AI Builder Into Server Write Surface
Langflow is a control plane for AI app instances, not just a low-code builder, and this flaw gives a stranger a way to write on the server from one unauthenticated request. In practice, the trust break is in the file endpoint: anonymous access gets a session by default, and the endpoint accepts a filename it should never trust from the requester.
The bug is CVE-2026-5027, a path traversal issue in POST /api/v2/files. Tenable says the endpoint does not sanitize the filename parameter, and VulnCheck says the flaw is being exploited in the wild; reporting also ties roughly 7,000 Langflow instances to public exposure, most in North America.
That makes exposed Langflow installs a foothold into the AI app infrastructure itself, not just a development console. File write is the immediate break, and it can be enough to move into remote code execution depending on what the server will run or load next.