Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

An unpatched security vulnerability, identified as CVE-2026-5027, within the open-source AI application development platform Langflow is actively being exploited. VulnCheck reported on March 18, 2026, that this critical flaw, with a CVSS score of 8.8, enables path traversal, allowing attackers to write files to any location on a vulnerable system. The exploitation targets a specific endpoint, '/upload_file', which lacks proper authentication and input validation. Attackers can leverage this weakness to upload malicious files, potentially leading to Remote Code Execution (RCE). The vulnerability arises from the platform's handling of file uploads, where user-supplied file paths are not sufficiently sanitized before being used to write data. This oversight permits attackers to manipulate the file path to write files outside of the intended upload directory, effectively gaining control over the server. Langflow, designed to simplify the creation of complex AI workflows, is widely used by developers to build applications powered by large language models. The active exploitation of CVE-2026-5027 poses a significant risk to users of the platform, as it can be exploited without requiring any prior authentication. As of the reporting date, no patch has been released by the Langflow developers to address this critical vulnerability, leaving users exposed to potential compromise. Security researchers are urging users to take immediate precautionary measures, such as restricting network access to the Langflow instance or monitoring for suspicious file activity, until a fix becomes available.