7,000 Langflow Servers Hit: LangGraph and LangChain Carry the Same Risk

Quick Facts

• CVE-2026-5027, a path traversal flaw in Langflow, has been actively exploited since June 8, 2026, with roughly 7,000 instances exposed publicly on the internet.
• Check Point Research found three vulnerabilities in LangGraph that can chain into full remote code execution, exposing LLM API keys, customer data, and internal network access.
• Cyera Research mapped three separate LangChain flaws, including one rated CVSS 9.3, that expose filesystem files, environment secrets, and conversation history.

A wave of attacks is hitting open-source AI development frameworks at scale. Langflow, LangGraph, and LangChain have each disclosed critical security flaws in 2026, and at least one is already being exploited in the wild.

The vulnerabilities affect infrastructure that collectively sees tens of millions of downloads each week. For companies building AI agents and applications on these tools, the exposure is direct and immediate.

Langflow: Active Exploitation, No Credentials Required

Langflow’s CVE-2026-5027 carries a CVSS score of 8.8. The flaw sits in the POST /api/v2/files endpoint, which fails to sanitize the filename parameter in multipart form data. Attackers can write files to arbitrary locations on the filesystem using path traversal sequences.

Caitlin Condon, Vice President of Security Research at VulnCheck, confirmed the severity: “Because Langflow enables unauthenticated auto-login by default, no credentials are required to reach the vulnerable endpoint, and a single unauthenticated request is sufficient to obtain a valid session token before proceeding with exploitation.”

VulnCheck added the flaw to its Known Exploited Vulnerabilities list on June 8, 2026, after its Canary sensors detected first-time exploitation in the wild. Observed attacks involved writing test files to victim systems, a common step before deploying destructive payloads.

Data from Censys counts about 7,000 publicly exposed Langflow instances, most in North America. Jim Sherlock, VP of AI and Cybersecurity R&D at ProCircular, put the number closer to 74,000.

Tenable discovered the flaw and attempted responsible disclosure three times between January and February 2026 before publishing advisory TRA-2026-26 on March 27, 2026. The fix landed in Langflow version 1.9.0 on April 15, 2026. Active attacks began in June, leaving every unpatched instance exposed for roughly two months.

This is not Langflow’s first rodeo. Earlier exploitation campaigns targeted CVE-2025-3248 to deliver the Flodrix botnet. The Iranian state-sponsored group MuddyWater has weaponized CVE-2025-34291.

LangGraph: SQL Injection Chains to Remote Code Execution

Check Point Research analyzed LangGraph, an open-source framework for stateful AI agents with over 50 million monthly downloads, and found three vulnerabilities in its persistence layer.

Security researcher Yarden Porat discovered all three flaws. Two chain directly into remote code execution: CVE-2025-67644, a SQL injection in the SQLite checkpointer, and CVE-2026-28277, an unsafe msgpack deserialization flaw. A third vulnerability, CVE-2026-27022, introduces the same injection class into the Redis checkpointer.

The attack chain works by exploiting the SQL injection to return a fake checkpoint row containing attacker-controlled serialized data, which the deserialization step then executes as arbitrary code. A compromised LangGraph server exposes everything the agent touches: LLM API keys, customer data, CRM credentials, conversation history, and internal network access.

Self-hosted deployments using the SQLite or Redis checkpointer are at risk when the application exposes the get_state_history() endpoint with a user-controlled filter. LangChain’s managed cloud service runs PostgreSQL and is not affected. Teams should update to langgraph-checkpoint-sqlite 3.0.1, langgraph 1.0.10, or langgraph-checkpoint-redis 1.0.2, depending on their stack.

LangChain: Three Flaws, Three Classes of Exposed Data

Cyera security researcher Vladimir Tokarev mapped three separate vulnerabilities in LangChain. “Each vulnerability exposes a different class of enterprise data: filesystem files, environment secrets, and conversation history,” Tokarev said.

CVE-2026-34070, rated CVSS 7.5, is a path traversal flaw triggered when LangChain resolves file paths while loading prompt templates. An attacker can read arbitrary files from the host system, including configuration files and stored credentials.

CVE-2025-68664, rated CVSS 9.3 and dubbed “LangGrinch,” affects the dumps() and dumpd() serialization functions. The functions failed to safely escape dictionaries containing reserved internal keys, allowing attacker-controlled input to be interpreted as trusted serialized objects rather than ordinary data.

What Founders and Engineering Leaders Should Do Now

Teams running any of these frameworks in production should audit their deployments immediately. Patch versions are available for all three platforms. Any self-hosted instance of Langflow below version 1.9.0 is actively being targeted. LangGraph and LangChain patches are available and should be applied without delay.

The pattern across all three frameworks is the same: insufficient input sanitization on endpoints that handle user-controlled data. As AI agent infrastructure scales, these attack surfaces will only grow.

Read more: 7,000 Langflow servers are under attack. LangGraph and LangChain have the same holes