langflow-ai vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 6 langflow-ai CVEs published between 2026-03-15 and 2026-06-15. The busiest month was 2026-06 (5 new CVEs). None of them is listed in CISA KEV yet.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked langflow-ai CVEs.

• CVE-2026-5027high 8.8EPSS 4.8%2026-03-27
• CVE-2026-55447critical 9.6EPSS 0.3%2026-06-23
• CVE-2026-55446high 7.5EPSS 0.3%2026-06-23
• CVE-2026-55450critical 9.3EPSS 0.3%2026-06-23
• CVE-2026-55255critical 9.9EPSS 0.2%2026-06-23
• CVE-2026-55423medium 6.1EPSS 0.2%2026-06-23

Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 1 distinct langflow-ai product is affected. The most frequently affected:

• langflow 6 CVEs

Threat activity

9 tracked threat campaigns reference langflow-ai products or exploit langflow-ai CVEs:

• GTIG: AI-Era Vulnerability Discovery and Exploitation Surge — In-the-Wild Exploitation of BeyondTrust CVE-2026-1731, LiteLLM CVE-2026-42271 and Langflow CVE-2026-5027CRITICAL2026-09-30
• CVE-2026-0768: Critical Langflow RCE Vulnerability Under Active ExploitationCRITICAL2026-09-01
• Langflow CVE-2025-3248 Unauthenticated RCE Exploited to Build Custom Gafgyt/BASHLITE DDoS BotnetCRITICAL2026-07-14
• CVE-2025-3248 & CVE-2026-5027: Langflow RCE and Path Traversal Chained for Flodrix Botnet DeploymentCRITICAL2026-07-12
• JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) to Automate Database Ransomware/Extortion AttackCRITICAL2026-07-05
• JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database ExtortionCRITICAL2026-07-04
• JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441)CRITICAL2026-07-02
• JADEPUFFER Agentic Ransomware Exploits Langflow CVE-2025-3248 and Nacos CVE-2021-29441 via Base64-Encoded Python PayloadsCRITICAL2026-07-02
• CVE-2026-5027: Path Traversal Arbitrary File Write in Langflow AI Dev Platform (upload_user_file) Exploited in the Wild for Unauthenticated RCEHIGH2026-06-10

Threat actors targeting langflow-ai

Named threat actors attributed to campaigns that involve langflow-ai products or CVEs, with the number of linked campaigns:

• JADEPUFFER 2

How to prioritise langflow-ai patching

This order follows the data Threadlinqs holds for langflow-ai, not a generic severity checklist:

• No langflow-ai CVE is in CISA KEV yet, so rank by exploit probability instead.
• Outside KEV, the highest EPSS scores are CVE-2026-5027 (4.8%), CVE-2026-55447 (0.3%), CVE-2026-55446 (0.3%).
• 3 CVEs score Critical and 2 High on CVSS v3 (maximum 9.9, average 8.5); sequence these after KEV and high-EPSS items.
• 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.