CVE-2026-5027 in Langflow: path traversal leads to unauthenticated RCE

Colleagues, a cybersecurity alert: CVE-2026-5027 is being exploited in Langflow.

- POST /api/v2/files path traversal: filename parameter is not sanitized; files can be written using '../'.
- Tenable reported the flaw; VulnCheck detects exploits; Censys finds ~7,000 public instances.
- Langflow’s default allows unauthenticated auto-login, making file writes trivial to escalate to RCE; so far attackers mostly write test files.

Why it matters: unauthenticated remote code execution on public systems demands immediate attention.

Have you checked your instances and applied patches?

#cybersecurity #vulnerabilities #AI #Langflow