Path Traversal in Langflow CVE-2026-5027 Enables Unauthenticated RCE on Exposed AI Tooling

The defect sits in the multipart filename parameter with no sanitization. Tenable disclosed after failed coordinated attempts; VulnCheck confirmed in-the-wild drops of test files followed by session token acquisition in one unauthenticated flow. Roughly 7000 internet-facing instances, concentrated in North America, remain reachable without credentials.

Open-source AI frameworks share the same rapid-deployment pattern: default permissive auth, file-handling endpoints, and minimal input validation. Similar exposures have appeared in Flowise and n8n within the same tooling class, where path traversal also mapped directly to RCE once an initial file write succeeded.

Procurement records show Langflow adopted inside multiple defense-adjacent labs for prototype pipelines; no public patch timeline or contract-mandated hardening appears in available solicitations. The 8.8 CVSS score understates operational reach because the flaw bypasses the very access controls marketed as enterprise-ready.

Expect continued scanning for analogous endpoints in other low-code AI platforms. Unpatched instances will see scripted exploitation within days once public PoC circulates.