7,000 Langflow Servers Face Vulnerabilities: LangGraph and LangChain Share Same Security Flaws

Recent findings highlight vulnerabilities in AI agent frameworks, revealing potential security risks that could allow attackers access to sensitive credentials and data. In the past months, three major AI frameworks transformed typical vulnerabilities into conditions for exploitation. Check Point Research exposed a SQL injection flaw in LangGraph’s SQLite checkpoint that leads to full remote code execution. Simultaneously, Tenable and VulnCheck identified a path traversal bug in Langflow that facilitates exploitation, while Cyera noted a similar security gap in LangChain-core’s prompt loader, allowing attackers to access sensitive information stored on disk. Despite the prevalence of these issues, these frameworks were deployed to production environments before adequate security measures were implemented.

The LangGraph Vulnerability: SQL Injection to Code Execution

LangGraph, a popular framework with over 50 million downloads in recent months, introduced memory capabilities through its checkpointing system. However, Check Point Research uncovered three vulnerabilities in this system, two of which allow for remote code execution. The first, designated CVE-2025-67644 and given a CVSS score of 7.3, involves a SQL injection in the SQLite checkpoint. Specifically, the method that constructs the WHERE clause incorporates user-defined keys directly into the SQL query without any parameterization or escaping, creating a serious risk for deployments where untrusted input is allowed.

The second vulnerability, CVE-2026-28277 (CVSS 6.8), represents a further escalation. LangGraph’s msgpack checkpoint decoder creates Python objects from saved data, granting attackers the ability to import modules and invoke designated functions with supplied arguments. This particular issue can be activated remotely via the SQL injection. A minor third flaw, CVE-2026-27022 (CVSS 6.5), allows similar access through the Redis checkpointer. While no known exploits of these vulnerabilities have occurred yet, proof-of-concept code is publicly available, and appropriate patches have been released.

The Langflow Vulnerability: Unauthenticated to RCE

Langflow has emerged as a critical target for attackers. The vulnerability CVE-2026-5027 (CVSS 8.8) is a path traversal issue in its POST /api/v2/files endpoint, allowing attackers to send filenames that traverse the file system unsanitized. Exposed instances do not require authentication due to the default auto-login setting, meaning attackers can execute an unauthenticated request to drop files like cron jobs, allowing them shell access.

The first signs of exploitation surfaced in June 2023, with approximately 7,000 instances in North America reported vulnerable. This vulnerability has been noted as the third to be actively exploited this year, following another flaw weaponized by a state-sponsored group. The patch for CVE-2026-5027 was made available earlier but was not effective enough in preventing the ensuing attacks.

The LangChain-core Vulnerability: Arbitrary File Access

LangChain-core, the backbone of both mentioned frameworks, has a flaw as well. The vulnerability, CVE-2026-34070 (CVSS 7.5), relates to its legacy prompt-loading API, where the load_prompt() function erroneously reads file paths without verifying them against traversals or absolute paths. This allows unauthorized users to access sensitive files, including API keys. Additionally, this flaw was associated with another significant deserialization vulnerability (CVE-2025-68664) affecting environment secrets resolution. Proper patch management is critical, as different fixes exist for the two vulnerabilities.

Understanding the Risks and Gaps

All three frameworks expose classic application security vulnerabilities: SQL injection, path traversal, and unsafe deserialization, which have persisted in modern AI infrastructures. These vulnerabilities often go unnoticed due to the lack of traditional security measures that treat these frameworks as potential attack vectors. Merritt Baer, a well-known security expert, emphasizes the pressing need for proper authentication protocols from day one to prevent ongoing security issues that arise from these insecure defaults.

Furthermore, many security teams categorize these frameworks incorrectly, equating them to less risky components, which leads to the absence of necessary security oversight. As organizations rapidly adopt AI agent frameworks, they must also recognize that they inherit risks associated with the tools and credentials within their operational environment.

Actionable Insights for Boards

While technical vulnerability indicators such as CVE numbers are useful, it’s imperative to focus on the operational impacts of these vulnerabilities. For instance, if an AI framework leads to erroneous business decisions through compromised data, the issue transcends traditional security incidents. Strategic presentations to boards should emphasize the potential consequences of these vulnerabilities, including the risks posed by unpatched systems and the severity of active attacks.

Checklist for Security Teams

Security teams should employ a systematic approach to assess exposure through a trust boundary checklist. Each item should verify whether agents can be manipulated, track file access, and ensure frameworks are included in the governance processes. Key actions include:

Each row represents an essential trust boundary for assessment.

Emphasizing Urgency to Decision-makers

The required adjustments are not extensive redesigns; they involve straightforward version updates and configuration tweaks that can be executed promptly. However, the time frame between the issuance of patches and the deployment of necessary security checks is widening considerably. Swift action is essential to mitigate risks effectively.