Langflow CVE-2026-5027 Actively Exploited: Iranian MuddyWater Uses AI App Platform Flaw for Remote Code Execution

A critical vulnerability in Langflow, the open-source low-code platform used to build AI-powered applications, is being actively exploited in the wild with no official patch available. The flaw, tracked as CVE-2026-5027 with a CVSS score of 8.8, enables an unauthenticated attacker to write files to arbitrary locations on the underlying filesystem and achieve full remote code execution without valid credentials.

Threat intelligence has linked exploitation of an earlier Langflow vulnerability to MuddyWater, an Iranian state-sponsored group attributed to MOIS (the Ministry of Intelligence and Security). MuddyWater's known targeting of GCC government, financial, and telecommunications infrastructure makes this disclosure directly relevant to Gulf organisations deploying Langflow in AI development environments.

What the Vulnerability Does

CVE-2026-5027 resides in Langflow's POST /api/v2/files endpoint. The filename parameter passed through multipart form data is not properly sanitised, allowing an attacker to inject path traversal sequences such as ../ to navigate outside the intended upload directory and write files anywhere on the underlying server filesystem.

The attack surface is widened further by Langflow's default configuration. The platform enables unauthenticated auto-login out of the box, meaning a single unauthenticated HTTP request is sufficient to obtain a valid session token. The combination of default unauthenticated access and an unsanitised file write endpoint creates a straightforward, unauthenticated remote code execution path that requires no special knowledge or tooling beyond a standard HTTP request.

The vulnerability was discovered and reported by Tenable Network Security, which made three disclosure attempts to the Langflow project maintainers beginning 20 January 2026 before publicly disclosing the flaw on 27 March 2026 after receiving no response. VulnCheck added CVE-2026-5027 to its Known Exploited Vulnerabilities list on 8 June 2026 after its Canary sensors detected first-time in-the-wild exploitation.

The Iranian Connection

Exploitation of Langflow by Iranian-affiliated threat actors is not a new pattern. CVE-2025-34291, a chained remote code execution vulnerability in Langflow combining overly permissive CORS settings, missing CSRF protections, and a code execution endpoint, was first disclosed in December 2025 and exploited in early 2026. Threat intelligence attributed that exploitation directly to MuddyWater.

This matters for GCC security teams. MuddyWater has consistently prioritised Gulf government, telecommunications, and critical infrastructure targets. As CISA's advisory on MuddyWater documents, the group's tradecraft centres on legitimate remote management tools, credential theft, and multi-stage persistence. Initial Langflow compromise is rarely the end state. It is typically a foothold for broader network access and lateral movement. The group's documented use of these techniques against Saudi government entities and UAE infrastructure underscores why any unpatched AI development tooling in GCC environments demands immediate attention. For a broader picture of how Iranian-aligned actors are operating against regional infrastructure in 2026, the NESA Cybersecurity Framework analysis on MENA Cyber Wire sets out the compliance baseline that Gulf organisations should already have in place.

The Scale of Exposure

A Censys query conducted by the VulnCheck team identified approximately 7,000 Langflow instances publicly exposed on the internet, with the highest concentration in North America. Exposure in the GCC is harder to quantify but Langflow adoption is accelerating across the region's AI development ecosystem in line with rapid enterprise AI investment in the UAE and Saudi Arabia.

Langflow is popular in GCC technology teams building AI-powered applications, agentic workflows, and internal automation tools. Any organisation that has deployed Langflow in an internet-facing configuration is currently exposed.

What to Do Now

There is no official patch available for CVE-2026-5027 at the time of publication. Security teams running Langflow should take three immediate actions.

First, remove Langflow from public internet access. Place any Langflow instance behind a VPN or zero-trust gateway. This eliminates the unauthenticated attack path entirely regardless of the underlying vulnerability. As outlined in the UAE Government Cybersecurity Summit 2026 coverage, zero-trust access architecture is now a board-level requirement across GCC enterprise environments, not an optional control.

Second, deploy Web Application Firewall rules to detect and block path traversal sequences in file upload requests. Pattern matching on ../ in multipart form submissions is a practical interim control.

Third, monitor the official Langflow GitHub repository for patch releases. Apply any available fix immediately upon release and treat the patching of this specific endpoint as a priority action in your change management process.

Organisations that have deployed Langflow in production AI development environments should also conduct a retrospective review of access logs from late May 2026 onwards, looking for anomalous file write activity or unexpected process execution from the Langflow service account. The same urgency applies here as it did with the Trellix source code breach: GCC enterprises using widely deployed platforms must treat any unpatched vulnerability in a privileged development environment as an active threat.