Langflow Remote Code Execution Vulnerability Exploited in Attacks (CVE-2026-0768)

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.

CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files.

Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable.

CVE-2026-5027 is a path traversal flaw (CWE-22) in the 'POST /api/v2/files' endpoint of Langflow, the open-source platform for building AI/LLM agent workflows. The endpoint fails to sanitize the 'filename' field supplied in multipart form data, so an attacker who submits a name containing '../' sequences can direct the resulting file write to arbitrary locations on the server's filesystem. The CVSS vector (network-accessible, low complexity, low-privilege account required, no user interaction) indicates an authenticated user can abuse this to overwrite or create files at attacker-chosen paths, which can compromise confidentiality, integrity, and availability — for example by overwriting configuration, credentials, or executable content that leads to code execution depending on deployment. Any organization running a self-hosted Langflow instance that exposes the files API, even to low-privileged accounts, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known for this specific CVE, and it is not yet on CISA's KEV list, but its elevated EPSS (36.1%, 98th percentile) and active exploitation of other Langflow vulnerabilities (e.g., CVE-2026-0768) suggest near-term exploitation risk.

Do: Upgrade Langflow to the latest patched release per the vendor advisory (specific fixed version is not stated in the available data). Until patched, restrict access to /api/v2/files to trusted, authenticated users, place Langflow behind authentication/reverse-proxy filtering that strips or validates '..' sequences in multipart filenames, and avoid exposing the instance directly to the internet. Review access logs for multipart POST requests to /api/v2/files with filenames containing '../' that could indicate attempted traversal writes.

Langflow, an open-source platform for building and deploying AI-powered agents and workflows, contains an authorization bypass (Insecure Direct Object Reference, CWE-639) in its /api/v1/responses endpoint in all versions prior to 1.9.1. An authenticated low-privileged user triggers the flaw by supplying another user's flow ID in the request, causing Langflow to execute that flow without verifying ownership. Because the attacker can run flows belonging to other users on a shared or multi-tenant instance, they can leverage those flows' configured credentials and integrations; public reporting indicates attackers are using the flaw for credential harvesting, which aligns with the flaw's high confidentiality and integrity impact (CVSS 3.1 score 8.4, with scope change). All Langflow deployments running anything earlier than 1.9.1 are affected, with multi-user or shared instances at greatest risk. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-07, confirming exploitation in the wild; ransomware use is currently unknown.

Do: Upgrade Langflow to 1.9.1 or later immediately, prioritizing internet-facing and multi-user instances, in line with CISA KEV and BOD 26-04 deadlines. If patching must wait, restrict access to /api/v1/responses to trusted users and review logs for requests specifying other users' flow IDs, which may indicate credential harvesting. Per BOD 26-04, evaluate each asset's internet exposure, follow the vendor advisory (GHSA-qrpv-q767-xqq2) for mitigations, and discontinue use where mitigations are unavailable.