Attackers Exploit Critical Langflow and Rails Flaws in Credential

Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available.

Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise.

CVE-2026-0769 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in Langflow, an open-source platform for building LLM applications, located in the eval_custom_component_code function. The function fails to properly validate a user-supplied string before using it to execute Python code, so a remote attacker who can reach the Langflow service without any credentials can submit a crafted string that is then executed as Python code. Successful exploitation yields arbitrary code execution in the context of the current process, with full confidentiality, integrity, and availability impact on the affected host. Any Langflow deployment is potentially exposed, particularly self-hosted or internet-facing instances that accept unauthenticated API requests. Exploitation of critical Langflow flaws has been reported in the wild in recent credential-focused campaigns; this CVE itself is not yet in CISA KEV and has no known public PoC, but its EPSS of 38% (98th percentile) signals high near-term exploitation risk.

Do: Upgrade Langflow to the patched release identified in the ZDI/Trend Micro advisory (ZDI-CAN-26972) as soon as it is available, since the flaw is fixed by proper validation in updated code. Until patched, restrict unauthenticated network access to Langflow instances — put them behind reverse-proxy authentication, firewall them from the internet, and monitor for signs of compromise such as unexpected child processes or outbound connections spawned by the Langflow service.

CVE-2026-5027 is a path traversal flaw (CWE-22) in the 'POST /api/v2/files' endpoint of Langflow, the open-source platform for building AI/LLM agent workflows. The endpoint fails to sanitize the 'filename' field supplied in multipart form data, so an attacker who submits a name containing '../' sequences can direct the resulting file write to arbitrary locations on the server's filesystem. The CVSS vector (network-accessible, low complexity, low-privilege account required, no user interaction) indicates an authenticated user can abuse this to overwrite or create files at attacker-chosen paths, which can compromise confidentiality, integrity, and availability — for example by overwriting configuration, credentials, or executable content that leads to code execution depending on deployment. Any organization running a self-hosted Langflow instance that exposes the files API, even to low-privileged accounts, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific CVE, and it is not yet on CISA's KEV list, but its elevated EPSS (36.1%, 98th percentile) and active exploitation of other Langflow vulnerabilities (e.g., CVE-2026-0768) suggest near-term exploitation risk.

Do: Upgrade Langflow to the latest patched release per the vendor advisory (specific fixed version is not stated in the available data). Until patched, restrict access to /api/v2/files to trusted, authenticated users, place Langflow behind authentication/reverse-proxy filtering that strips or validates '..' sequences in multipart filenames, and avoid exposing the instance directly to the internet. Review access logs for multipart POST requests to /api/v2/files with filenames containing '../' that could indicate attempted traversal writes.

CVE-2026-66066 is a flaw in Active Storage (part of Ruby on Rails' Action Pack) in which libvips operations that are marked unsafe for untrusted content are not disabled, so a crafted upload can invoke such an operation on the server. It is triggered when an unauthenticated attacker uploads a maliciously crafted image to a Rails application that is configured to use libvips and accepts image uploads from untrusted users. Successful exploitation lets the attacker read arbitrary files accessible to the Rails process, including environment variables and application secrets; leaked credentials such as secret_key_base or external-service tokens can be leveraged for remote code execution or lateral movement. Affected applications are those running Rails 7.2.x, 8.0.x or 8.1.x before the patched releases 7.2.3.2, 8.0.5.1 and 8.1.3.1, provided Active Storage with libvips is in use. Public exploit code is not yet documented, but news reports describe active attacks against Rails apps (a campaign referred to as "KindaRails2Shell"), EPSS assigns a 27.9% probability of exploitation within 30 days (98th percentile), and the flaw is not yet listed in CISA KEV.

Do: Upgrade Rails to 7.2.3.2, 8.0.5.1 or 8.1.3.1 depending on your release series. If patching is delayed, restrict or disable libvips processing of untrusted uploads (e.g., limit image variant/preview generation) and review upload and application logs for suspicious image submissions. Treat secrets as potentially compromised on any exposed app: rotate secret_key_base and API/service tokens, and check for signs of follow-on compromise such as forged sessions or unexpected outbound connections.