Loading story…
Two high-severity vulnerabilities were disclosed in widely used AI application components, affecting Langflow and vLLM. In Langflow, CVE-2026-33497 impacts versions before 1.7.1 and stems from improper filtering of folder_name and file_name in the /profile_pictures/{folder_name}/{file_name} endpoint. The path traversal flaw (CWE-22) allows unauthenticated attackers to read files across directories, including the application's secret_key, creating a direct risk of secret exposure and follow-on compromise. The issue is addressed in Langflow 1.7.1 and tracked in GitHub advisory GHSA-ph9w-r52h-28p7.
A separate flaw in vLLM, CVE-2026-27893, can lead to remote code execution by bypassing a user's attempt to disable remote code trust. In versions from 0.10.1 up to but not including 0.18.0, two model implementation files hardcoded trust_remote_code=True, overriding the safer --trust-remote-code=False setting and allowing malicious model repositories to run code during model use. The vulnerability, classified as CWE-693, was patched in vLLM 0.18.0, underscoring supply-chain and configuration-bypass risks in AI infrastructure components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
vLLM version 0.18.0 fixed the hardcoded trust_remote_code=True behavior in NemotronVL and KimiK25 model implementations. GitHub security advisories on the CVE referenced the fixing commit, pull request, and advisory.
A vulnerability in vLLM versions 0.10.1 through before 0.18.0 was disclosed after researchers found two model implementation files hardcoded trust_remote_code=True, overriding users' explicit security opt-out. This could enable remote code execution from malicious model repositories.
Langflow version 1.7.1 was identified as containing the fix for CVE-2026-33497, addressing the file-reading issue in the profile picture download handler. The advisory references GitHub Security Advisory GHSA-ph9w-r52h-28p7.
A path traversal vulnerability affecting Langflow versions before 1.7.1 was disclosed, involving insufficient filtering of folder_name and file_name in the /profile_pictures/{folder_name}/{file_name} endpoint. The flaw could allow attackers to read files across directories, including the application's secret_key.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
Multiple vulnerabilities in **Langflow** have exposed AI application deployments to both account-to-account abuse and active compromise. **`CVE-2026-33760`** affects versions before **1.9.0** and allows authenticated users to read, modify, rename, or delete other users’ messages, sessions, build artifacts, and LLM transaction logs through seven `/api/v1/monitor` endpoints that fail to enforce ownership checks. A separate flaw, **`CVE-2026-55255`**, affects versions before **1.9.2** and lets an authenticated attacker execute another user’s flow through the `/api/v1/responses` endpoint by supplying a victim `flow_id`, giving the issue a critical **CVSS 9.9** rating. At the same time, defenders are tracking a cryptocurrency-mining campaign exploiting **`CVE-2026-33017`**, an unauthenticated remote code execution bug in Langflow, to compromise exposed instances and deploy Monero miners. Threat research says the malware disables security controls, installs persistence, and can enable lateral movement through reused SSH keys; observed infrastructure includes **`83.142.209.214`** and **`94.156.64.241`**. Organizations running Langflow are being urged to upgrade to **1.9.0** and **1.9.2** or later as applicable, verify access-control enforcement, restrict public exposure of Langflow services, and treat signs of miner activity or unauthorized flow execution as a significant incident.
Jun 30, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026