Loading story…
A critical vulnerability in the LangChain-based no-code LLM development platform Langflow exposed internet-facing instances to unauthenticated remote code execution. Tracked as CVE-2025-3248 and rated CVSS 9.8, the flaw was disclosed after researchers showed that unsafe use of Python exec could be abused through Langflow's code-validation functionality, allowing attackers to run arbitrary Python on vulnerable servers.
Security monitoring by MBSD-SOC found exploitation attempts beginning on April 10, 2025, shortly after public disclosure on April 8. Attackers were observed sending crafted POST requests to the /api/v1/validate/code endpoint to execute malicious Python, including attempts to read sensitive files such as /etc/passwd. The report said proof-of-concept code and real-world abuse were already circulating, and urged organizations to update Langflow immediately; telemetry cited the Netherlands and France as the source of roughly half of observed attack traffic.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC reported first seeing attacks targeting CVE-2025-3248 on April 10, 2025, shortly after disclosure. The observed activity used crafted POST requests to the /api/v1/validate/code endpoint, including payloads attempting to read /etc/passwd via arbitrary Python execution.
Horizon3.ai published research on abusing Python exec for unauthenticated remote code execution in Langflow AI, providing technical disclosure details referenced by MBSD-SOC.
CVE-2025-3248, a critical unauthenticated remote code execution flaw in the LangChain-based no-code LLM tool Langflow, was disclosed. The MBSD-SOC report states the vulnerability has a CVSS score of 9.8 and notes that proof-of-concept code and abuse reports had already emerged.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated remote code execution flaw in Langflow, tracked as **`CVE-2026-0770`**, has been actively exploited against the platform’s `/api/v1/validate/code` endpoint. The vulnerability affects Langflow versions **0.0.31 through 1.7.3** and stems from unsafe use of Python’s `exec()` during server-side code validation, allowing attackers to submit crafted function definitions that execute arbitrary operating system commands. Reported post-exploitation activity included reconnaissance, credential theft, environment-variable collection, cloud metadata access, and retrieval of second-stage payloads. CISA added **`CVE-2026-0770`** to its **Known Exploited Vulnerabilities** catalog and directed U.S. federal civilian agencies to remediate it under **BOD 26-04**, while Langflow addressed the issue in its **`release-1.10.1`** branch by replacing `exec()`-based validation with compile-only validation and adding regression tests. Separately, a **Metasploit** exploit module for the bug is under active development in the Rapid7 framework, increasing the likelihood of broader weaponization. Organizations with internet-facing Langflow deployments are being urged to patch immediately and investigate exposed systems as potentially compromised even after remediation.
Aug 4, 2026
Threat actors are actively exploiting **CVE-2026-0768**, a critical unauthenticated remote-code-execution flaw in the Langflow AI low-code platform. Rated CVSS 9.8, the vulnerability affects Langflow versions through 1.4.2 and allows arbitrary Python code execution as root through insufficient validation in the custom-component editor’s code validator. VulnCheck recorded more than 360 exploitation attempts against U.K. canaries, largely from Russian-origin infrastructure, seeking environment variables, Langflow secrets, SSH details, and shell-history metadata. The activity follows broader disclosures affecting Langflow OSS 1.x releases prior to 1.11.2, including critical and high-severity flaws enabling RCE, privilege escalation, arbitrary file reads, and information disclosure. Organizations should upgrade Langflow to the vendor-fixed releases—at least 1.11.2 where applicable—remove public exposure where possible, rotate credentials accessible to Langflow, and investigate for unauthorized environment-variable access, proxy deployment, cryptomining, audit-log changes, and lateral scanning. Public exploit development is also progressing: a proposed Metasploit module targets the separate authenticated RCE **CVE-2026-5027**.
Sep 3, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026