Attackers Exploit Critical Langflow Flaw for Remote Code Execution

A critical path traversal vulnerability (CVE-2026-5027) in Langflow’s POST /api/v2/files endpoint allows unauthenticated attackers to write arbitrary files and chain to remote code execution; exploitation is already observed in the wild, around 7,000 instances are Internet-exposed, and no vendor patch was available at disclosure, so organizations should immediately restrict access, monitor file activity, and deploy network/web controls.