CVE-2026-5027: Path Traversal Arbitrary File Write in Langflow AI Dev Platform (upload_user_file) Exploited in the Wild for Unauthenticated RCE

CVE-2026-5027 (TL-2026-0766), also tracked as TRA-2026-26, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-06-10. It has no confirmed attribution, affects Langflow (langflow-ai) Langflow, references 1 CVE (CVE-2026-5027), maps to 17 MITRE ATT&CK techniques (T1005, T1036, T1041), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0766

Threat ID
TL-2026-0766
Also known as
TRA-2026-26, SNYK-PYTHON-LANGFLOWBASE-15842030
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-10
Last reviewed
2026-06-10
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
technology, artificial-intelligence, software-development, cloud-services
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in CVE-2026-5027

Malware and tooling: yahiahamza/CVE-2026-5027 PoC

CVE-2026-5027 is a path traversal flaw (CWE-22, CVSS 8.8) in Langflow's POST /api/v2/files upload endpoint: the upload_user_file() handler passes the multipart filename straight to the storage service without sanitization, so '../' sequences let an attacker write files anywhere on disk. Because Langflow ships with unauthenticated auto-login by default, the endpoint is reachable without credentials, turning arbitrary file write into unauthenticated remote code execution via cron, SSH authorized_keys, or webshell. Tenable disclosed it on 2026-03-27 (TRA-2026-26); it is now actively exploited against publicly exposed instances per VulnCheck honeypot data.

How CVE-2026-5027 works

CVE-2026-5027 is an arbitrary file write vulnerability in Langflow, a popular open-source visual framework for building LLM/agent pipelines. The defect lives in the v2 file-upload API. In src/backend/base/langflow/api/v2/files.py, the upload_user_file() function takes the 'filename' field from the multipart/form-data request and passes file.filename directly to the storage service without normalizing or validating the path. An attacker who supplies a filename containing path-traversal sequences ('../../../') can therefore break out of the intended per-user upload directory and write the uploaded bytes to any location the Langflow process can reach on the host filesystem.

The vulnerability is classified CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal). Tenable scored it CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS v4 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). Although the base vector lists PR:L (low privileges), the practical authentication requirement collapses to none: Langflow enables unauthenticated 'auto-login' by default, so a single unauthenticated HTTP request yields a valid session token, after which the file-write endpoint is fully reachable. The result is unauthenticated remote code execution.

Arbitrary file write is escalated to code execution through several well-known primitives: writing a crontab entry into the cron spool (e.g. /etc/cron.d/ or a user crontab) to run an attacker command as root on the next schedule tick; appending an attacker public key to ~/.ssh/authorized_keys to gain interactive SSH access; or dropping a webshell into a web-served directory. The public proof-of-concept (GitHub: yahiahamza/CVE-2026-5027) automates a basic file-write test, an authenticated mode, and a reverse-shell payload (default port 4444), confirming low exploitation complexity.

The flaw affects Langflow application releases up to and including 1.8.4 (i.e. < 1.9.0) and the langflow-base package < 0.8.3. It was remediated in Langflow 1.9.0 / langflow-base 0.8.3 (2026-03-30); users are advised to move to 1.10.0 (released 2026-06-10). Tenable researcher Joshua Martinelle attempted coordinated disclosure with three contact attempts in January-February 2026 and a final notice on 2026-03-23 before publishing advisory TRA-2026-26 on 2026-03-27 with no vendor fix available at publication.

Exploitation in the wild was observed by VulnCheck honeypots. Within roughly 48 hours of the advisory, six unique source IPs probed honeypot instances; four of them arrived within minutes of each other delivering an identical payload, consistent with automated, opportunistic scanning. The most advanced activity came from 173.212.205.251, which staged a second-stage dropper at http://173.212.205.251:8443/z and ran a thorough credential-harvesting routine, including dumping the full process environment — which in a typical Langflow deployment exposes database connection strings, API keys, and cloud credentials. Censys data shows roughly 7,000 publicly exposed Langflow instances (default service port 7860), the majority in North America, defining a large opportunistic attack surface. CVE-2026-5027 belongs to a cluster of 2026 Langflow vulnerabilities under active attack alongside CVE-2025-34291 (origin-validation RCE, CVSS 9.4, added to CISA KEV and weaponized by MuddyWater), CVE-2026-33017 (unauthenticated RCE exploited within ~20 hours, used to steal AWS keys and deploy a NATS worker), CVE-2026-0770, and CVE-2026-21445.

MITRE ATT&CK techniques used in TL-2026-0766

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter

Persistence

T1053 Scheduled Task/Job; T1098 Account Manipulation; T1505 Server Software Component

Privilege Escalation

T1053 Scheduled Task/Job

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Command and Control

T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Credential Access

T1552 Unsecured Credentials

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Resource Development

T1608 Stage Capabilities

Affected products and versions in CVE-2026-5027

  • Langflow (langflow-ai) — Langflow
    Vulnerable versions: <= 1.8.4; < 1.9.0
    Fixed in: 1.9.0; 1.10.0
  • Langflow (langflow-ai) — langflow-base
    Vulnerable versions: < 0.8.3
    Fixed in: 0.8.3
  • IBM — IBM Langflow Desktop
    Vulnerable versions: bundling langflow-base < 0.8.3
    Fixed in: build with langflow-base >= 0.8.3

Remediation for CVE-2026-5027

Patches

  • Langflow 1.9.0 (fixed)
  • Langflow 1.10.0 (recommended, 2026-06-10)
  • langflow-base 0.8.3 (fixed)

Immediate actions

  • Upgrade Langflow to 1.10.0 (or at minimum 1.9.0) and langflow-base to >= 0.8.3 immediately
  • Remove Langflow instances from direct internet exposure; place behind a VPN, reverse proxy, or IP allow-list
  • Disable Langflow's default unauthenticated auto-login (LANGFLOW_AUTO_LOGIN=false) and enforce strong authentication
  • Block the POST /api/v2/files endpoint at the WAF/reverse proxy for untrusted sources and reject filenames containing '../' or absolute paths

Workarounds

  • Set LANGFLOW_AUTO_LOGIN=false and require authentication
  • Restrict network access to the 7860 service port to trusted hosts only
  • WAF rule rejecting multipart filenames containing path-traversal sequences

Longer-term hardening

  • Run Langflow as a low-privilege, non-root user inside a hardened container with a read-only root filesystem and no cron/SSH writability
  • Egress-filter the host so a compromised Langflow cannot reach attacker stage-2 infrastructure
  • Rotate all secrets reachable from the Langflow process environment (DB strings, API keys, cloud credentials) if exposure is suspected
  • Deploy file-integrity monitoring on cron spools, authorized_keys, and web-served directories

CVEs associated with CVE-2026-5027

CVE-2026-5027

Weaknesses (CWE) in CVE-2026-5027

CWE-22

Timeline of CVE-2026-5027

  • Tenable (Joshua Martinelle) made first coordinated-disclosure contact attempt to Langflow maintainers.
  • Tenable second contact attempt to Langflow maintainers.
  • Tenable third contact attempt to Langflow maintainers.
  • Tenable issued final notice to maintainers before publication.
  • Tenable published advisory TRA-2026-26 and NVD record for CVE-2026-5027 (CVSS 8.8, CWE-22); no vendor fix available at publication.
  • Fix released in Langflow 1.9.0 and langflow-base 0.8.3; NVD record last modified.
  • CISA added related Langflow flaw CVE-2025-34291 to the KEV catalog (FCEB remediation due 2026-06-04).
  • VulnCheck honeypots observed active exploitation of CVE-2026-5027 in the wild; Langflow 1.10.0 released and public PoC available.

Sources cited for CVE-2026-5027

Threats related to CVE-2026-5027

Detection coverage for TL-2026-0766

As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0766 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats