[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2ZXGlwaTpLXFjONUyBR9E_CvSX6RhrJDVmnXI_kVWfs":3},{"article":4,"iocs":54,"watch_terms":69,"solutions":70,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"7c7123ed-80ee-445b-87d1-7e880f994f3a","Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE","unpatched-langflow-flaw-cve-2026-5027-exploited-for-unauthenticated-rce-efdaae","A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to findings from VulnCheck. The vulnerability in question is CVE-2026-5027 (CVSS score: 8.8), a case of path traversal that could allow an attacker to write files to arbitrary locations. \"The 'POST \u002F","A critical path traversal vulnerability (CVE-2026-5027) in the open-source AI platform Langflow is being actively exploited. The flaw allows unauthenticated attackers to write files to arbitrary locations, leading to remote code execution due to Langflow's default unauthenticated auto-login. This exploitation follows a pattern of attacks targeting AI development tools, with thousands of Langflow instances exposed online.","Unpatched Langflow flaw CVE-2026-5027 exploited for unauthenticated RCE.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Funpatched-langflow-flaw-cve-2026-5027.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEidDfz-Q5s2ON-nc6gW-4Lgw1yMocr3YiLP82vXcoWHcs6-_ICHWHZsciCnM2aU4kBZ2yyCJ622deCwKAXZdOFVyIoG41JC7SHyXIG6soj-RrFySsKHp2N51PpbGb7LxJWXvqOXE6GTap75h_QIjH78l0Ys__M_4EtgxMgymWgCS1vfdmWmwgpkW1TIq61I\u002Fs1600\u002Flang.png","2026-06-10T15:00:59+00:00","2026-06-10T16:00:30.584114+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Langflow","product",{"name":21,"type":22},"MuddyWater","threat_actor",{"name":24,"type":25},"VulnCheck","vendor",{"name":27,"type":25},"Tenable",{"name":29,"type":30},"AI","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,64,66],{"type":56,"value":57,"context":58},"cve","CVE-2026-5027","Path traversal vulnerability allowing arbitrary file write and RCE.",{"type":56,"value":60,"context":61},"CVE-2026-0770","Previously exploited Langflow vulnerability.",{"type":56,"value":63,"context":61},"CVE-2026-33017",{"type":56,"value":65,"context":61},"CVE-2026-21445",{"type":56,"value":67,"context":68},"CVE-2025-34291","Previously exploited Langflow vulnerability, weaponized by MuddyWater.",[24,27,18],{"controls":71,"vendors":154},[72,100,125],{"slug":73,"name":74,"problem":75,"products":76},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[77,85,92],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":86,"vendor_name":27,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,117],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":101,"product_name":114,"url":115,"description":116},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":126,"name":127,"problem":128,"products":129},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[155],{"slug":86,"name":27,"logo_path":87,"roles":156},[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":169},"critical-langflow-vulnerability-enables-unauthenticated-remote-code-execution","Critical Langflow Vulnerability Enables Unauthenticated Remote Code Execution","A critical path traversal vulnerability (CVE-2026-5027) in Langflow allowed attackers to write files to arbitrary system locations without authentication. The exploit was amplified by Langflow's default configuration that enables automatic unauthenticated login, creating a perfect storm for remote code execution. This incident highlights the dangerous combination of unpatched vulnerabilities and insecure default configurations in AI development platforms. With thousands of exposed instances online, organizations running AI tools must prioritize both timely patching and secure configuration management.",[163,164,165,166,167,168],"CIS Control 7","CIS Control 6","NIST CM-2","NIST AC-2","NIST SI-2","OWASP Top 10 A06",{}]