Path traversal flaw in AI dev platform Langflow exploited in attacks

Langflow is being actively exploited via CVE-2026-5027, a high-severity unauthenticated path traversal in its file upload endpoint that permits arbitrary file writes; Tenable disclosed the flaw, fixes were issued (langflow-base 0.8.3 and Langflow 1.9.0, with a recommendation to upgrade to 1.10.0), and honeypots and Censys scan data show active exploitation and many potentially exposed instances.