Am I vulnerable?
CVE-2026-5027 affects Langflow, the popular open-source visual builder for LangChain/LLM agent workflows (Python/FastAPI, default port 7860). The POST /api/v2/files endpoint does not sanitize the filename field of the multipart upload, so an attacker can use ../ path-traversal sequences to write an attacker-controlled file anywhere the Langflow process can write. That is the classic arbitrary-file-write primitive, and on a Python app it converts to remote code execution.
The official CVSS vector lists PR:L (a low-privilege account), but that matters far less than it looks. Langflow is routinely deployed exposed to the internet with authentication disabled (LANGFLOW_AUTO_LOGIN) or on default credentials, and the product has a history of pre-auth breaks: the earlier CVE-2025-3248 Langflow RCE is CISA-KEV. Treat any internet-reachable Langflow below 1.9.0 as exploitable.
Affected versions
| Product |
Vulnerable range |
Fixed in |
Langflow (PyPI langflow, langflow-ai/langflow) |
all versions before 1.9.0 |
1.9.0 |
Diagnostic checks (read-only)
"Vulnerable" means a Langflow install below 1.9.0 that is reachable over the network. Run whichever fits your access.
- Version, pip install:
pip show langflow (or pipx list) and read Version:. Below 1.9.0 is vulnerable.
- Version, Docker:
docker ps --format '{{.Image}}' | grep -i langflow, then read the image tag. Anything below 1.9.0 (or a floating latest pulled before 2026-06-11) needs verification.
- Is it exposed?:
ss -ltnp | grep 7860 (or your configured port). A bind on 0.0.0.0 or a public interface, not just 127.0.0.1, is the priority case.
- Is auth actually on?: check for
LANGFLOW_AUTO_LOGIN=true in the environment or compose file, and whether the default superuser credentials were ever rotated. Auto-login is effectively pre-auth.
- Non-destructive presence probe:
curl -4 -I 'http://TARGET:7860/'. A 200/302 to the Langflow UI confirms it is live and routable. Do not send traversal payloads at systems you do not own.
- Post-compromise triage (read-only): look for files the app should never have written, such as recently modified
*.py under the installed langflow/site-packages tree, and unexpected new files in the process home dir, ~/.ssh/authorized_keys, cron directories, or web-served paths. Example: find ~ /var/tmp -newermt '2026-07-06' -type f \( -name '*.py' -o -name 'authorized_keys' \) -printf '%Tc %p\n' 2>/dev/null.
Vulnerability
This is a CWE-22 improper path-limitation flaw leading to arbitrary file write. Langflow's v2 file API (POST /api/v2/files) takes the filename from the multipart Content-Disposition header and joins it to the upload directory without stripping directory-traversal sequences. Supplying a filename such as ../../../../opt/langflow/app/exploit.py walks out of the intended upload folder and drops the attacker's bytes at that absolute location.
Arbitrary file write on a Python/FastAPI service is a full remote-code-execution primitive, because the attacker simply chooses a destination that gets executed:
- overwrite or shadow a
.py module Langflow imports (or drop one onto the import path)
- write
~/.ssh/authorized_keys for interactive access
- drop a cron entry or a systemd/startup script
- clobber a config file to redirect execution
Because the primitive is a direct-to-disk write, there is no memory-corruption fragility or exploit-reliability problem to solve. The request either lands the file or it does not. Tenable Research discovered the flaw (TRA-2026-26, CVSS v3.1 8.8 HIGH, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the network-reachable, low-complexity, no-interaction shape is exactly the profile commodity scanning tooling weaponizes.
Why it's the week's top mover. EPSS sat flat at 2.1% (79th percentile) for the whole prior week, then jumped to 31.4% (98th percentile) in a single day (2026-07-13). That is a discrete step, not a drift, meaning the model ingested a fresh exploitation signal. CVE Brief's own exploit index corroborates it: a nuclei detection template now exists for this CVE. A dormant four-month-old HIGH just acquired public tooling, which is the textbook early-warning pattern, and it is not on CISA KEV, so it is invisible to deadline-driven programs.
Threat model
Who would exploit this: opportunistic mass-scanners and initial-access brokers who fingerprint internet-facing Langflow instances and fire a single upload request at scale. Langflow's audience is AI/ML teams standing up agent workflows quickly, often as shadow IT, which skews toward exposed, unhardened deployments. That is precisely the population commodity tooling harvests, and the freshly published nuclei template lowers the barrier to "point and scan."
What they're after:
- Drop a web-executable payload or Python module for a persistent foothold and code execution as the Langflow user
- Steal the secrets Langflow holds by design: LLM provider API keys, database URIs, and connected-tool credentials stored in flows and environment. This is a high-value, monetizable target unique to this class of app.
- Pivot into connected data sources, vector stores, and internal services the agent workflows reach
- Resell the initial access, or stage cryptomining or ransomware from the host
Attack chain: scan for Langflow (:7860, recognizable UI/API), send one unauthenticated (or low-priv) POST /api/v2/files with a ../-laden filename, the server writes the attacker's file to a chosen path, and the attacker triggers execution (request a web-reachable script, or wait for the imported module, cron, or login). From there they establish persistence and harvest credentials.
Blast radius: code execution as the Langflow process user exposes every secret wired into the platform: model keys, connected-database and API credentials, and flow definitions. Because Langflow sits at the center of an agent stack, that foothold is a springboard into whatever those agents can reach (internal APIs, data stores, cloud credentials). On shared hosting the same account often reaches adjacent services.
Mitigation
Patch
Upgrade to Langflow 1.9.0 or later immediately. The vendor confirmed the fix in 1.9.0 (2026-06-11). Do not wait for a maintenance window if the instance is internet-reachable.
| Product |
Fixed version |
Notes |
Langflow (langflow) |
1.9.0 |
Adds sanitization of the upload filename, closing the /api/v2/files traversal |
Compensating controls
Until you can patch, and as durable hardening afterward:
- Get it off the public internet. Bind to
127.0.0.1 and front it with a VPN or an authenticating reverse proxy. Never expose :7860 directly.
- Enable authentication. Set
LANGFLOW_AUTO_LOGIN=false and rotate the default superuser credentials.
- WAF or reverse-proxy rule. Block
POST /api/v2/files requests whose multipart filename contains ../, ..%2f, ..%5c, or an absolute path.
- Least privilege. Run Langflow as an unprivileged user in a container with a read-only root filesystem and a narrowly writable uploads volume, so a traversal write cannot reach startup scripts, cron, or SSH keys.
- Egress filtering. Restrict outbound connections from the Langflow host to blunt credential exfiltration and second-stage pulls.
Detection (starter rules, validate before deploying)
Network and log signals
The traversal lives in the request body (the multipart Content-Disposition filename), not the URL, so a plain access log will not show it. You need reverse-proxy/WAF body inspection or Langflow's own application logs.
- High confidence: any
POST /api/v2/files whose multipart filename contains ../, ..%2f, ..%5c, or a leading /.
- Baseline visibility (URL-only logs): alert on
POST /api/v2/files from external sources as a low-severity signal, then pivot on source IP, request volume, and 2xx responses.
- Host side: file-integrity monitoring on the Langflow install tree, the process home directory, cron paths, and
~/.ssh/. A write there from the Langflow user is the successful-exploitation signal.
YARA
This is a network exploit with no fixed malware artifact, so YARA is a post-write hunt aid, not primary detection. Use it to sweep for a dropped Python or webshell payload, and expect tuning:
rule Langflow_CVE_2026_5027_dropped_payload_heuristic
{
meta:
description = "Heuristic: suspicious script artifact possibly written via CVE-2026-5027 arbitrary file write. Broad, validate against your baseline."
reference = "https://www.tenable.com/security/research/tra-2026-26"
cve = "CVE-2026-5027"
strings:
$py_exec1 = "os.system("
$py_exec2 = "subprocess.Popen("
$py_exec3 = "__import__('os')"
$shell1 = /eval\(request\.(args|form|data)/
$shell2 = "pty.spawn"
condition:
// scope this to files found OUTSIDE the legitimate Langflow uploads dir
filesize < 50KB and 2 of them
}
Sigma
title: Langflow Path Traversal Arbitrary File Write (CVE-2026-5027)
id: 5c7f9a2e-0b3d-4e6a-9c1f-langflow5027
status: experimental
description: Detects exploitation of Langflow POST /api/v2/files where the multipart filename uses ../ traversal to write outside the upload directory.
references:
- https://www.tenable.com/security/research/tra-2026-26
logsource:
category: webserver
detection:
endpoint:
cs-method: POST
cs-uri-path|contains: '/api/v2/files'
traversal_in_body:
c-filename|contains:
- '../'
- '..%2f'
- '..%5c'
- '..\'
condition: endpoint and traversal_in_body
fields:
- c-ip
- c-filename
- sc-status
falsepositives:
- Legitimate uploads never carry ../ in the filename, so expect near-zero FP when the body is inspected.
level: high
Rule notes
- If your proxy cannot inspect the multipart body, drop
traversal_in_body and keep endpoint alone as a low-severity "someone is touching the file-upload API" signal, then triage by source IP and response code.
- The CVSS vector is
PR:L, but Langflow's common auth-disabled deployment means many real-world instances are exploitable pre-auth. Do not rely on "authenticated-only" as a mitigating assumption.
- A successful write is silent at the network layer. The durable signal is the host-side file appearing where Langflow should never write, so pair the Sigma rule with file-integrity monitoring.
References