Hackers Exploit Langflow Vulnerability for Remote Code Execution

▤ Summary

Attackers are exploiting a high-severity vulnerability in Langflow that can lead to remote code execution. The flaw affects the file upload endpoint and lets unauthenticated users write files to arbitrary locations through path traversal. Because Langflow enables unauthenticated auto-login by default, attackers can reach the vulnerable endpoint without credentials. VulnCheck also reports that exploitation attempts are already happening in the wild, and roughly 7,000 internet-exposed instances may be affected.

▦ Linked Companies

Tenable, Inc.

$500M to $1B

VulnCheck

$1M to $5M