AI Security and Intelligent Operations
Assisting the Launch of the National AI Vulnerability Database: Cyritex Releases High-Risk Vulnerability Special Assessment and Reproduction Report for Langflow
Recently, the "National AI Security Vulnerability Database Launch Ceremony" kicked off with grand scale in Beijing. As a technical support partner of CNNVD, Saixun Technology was invited to attend the event, witnessing the historic milestone of China's AI security governance entering normalized operation: security risks within the AI toolchain are now treated as an independent threat category by national agencies and put under regular monitoring.
Saixun Security Lab has maintained constant research on this. The attack library of Saixun Intelligence Security Validation Platform is updated in tandem with the "Important Artificial Intelligence Vulnerability Bulletins" continuously published by CNNVD. We have performed deep replication and forward-looking analysis on the high-severity vulnerabilities of Langflow, a globally watched AI infrastructure. Our research shows that under default configurations, these vulnerabilities are enough to allow attackers to "enter as if no one is watching." As an operational salute to the launch of the AI Security Vulnerability Database, this article will be the first to disclose the deep technical details and verification plans for these vulnerabilities.
Through the lab's independent replication analysis and validation, we found that both vulnerabilities allow unauthenticated remote code execution under default configurations, making the level of threat much more severe than described in the original NVD entry:
Important Version Warning: CVE-2026-33017 was patched in 1.8.2. CVE-2026-5027 still impacts up to 1.8.4, meaning enterprises that have upgraded to 1.8.2/1.8.3 are still exposed to the threat of the second vulnerability.
Saixun Intelligence Security Validation Platform has finished building the validation rules for the two above-mentioned vulnerabilities, and possesses continuous validation capabilities covering 10 AI applications and 40+ vulnerabilities. Enterprise security teams can directly verify whether their existing defensive systems can effectively intercept real attack payloads targeting Langflow through the Saixun Intelligence Security Validation Platform.
Overview of Saixun Intelligence Security Validation Platform's AI Vulnerability Verification Rule Database
The Signal: AI Infrastructure Vulnerabilities Upgraded from "Edge Threats" to "Key Control Areas"
In 2026, the growth rate of AI infrastructure vulnerabilities has outpaced the expectations of most security teams.
Since the beginning of 2026, CNNVD has released an "Important Artificial Intelligence Vulnerability Bulletin" every two weeks. As of April 2026, a total of 5 issues have been released, collecting 974 AI-related vulnerabilities, in which:
Critical vulnerabilities (CVSS ≥ 9.0): account for approximately 11%, much higher than the average for traditional application software vulnerabilities
High vulnerabilities (CVSS 7.0–8.9): account for approximately 34%
Involved vendors/projects include widely deployed AI infrastructure platforms like OpenClaw, Ollama, MLflow, and Langflow
On average, about 23 new AI toolchain vulnerabilities are added daily. The fundamental driver of this trend is the severe misalignment between the rapid expansion of AI infrastructure and its security maturity:
Typical Security Blind Spots in Corporate AI Toolchains:
Deployment Speed Crushing Security Auditing:
The deployment cycle of AI workflow orchestration tools (Langflow, n8n), model training platforms (MLflow), and model serving frameworks (BentoML, Ollama) is measured in hours, leaving no time for security assessments to step in.
Direct Internet Exposure:
A significant percentage of Langflow instances are directly exposed to the public network without modified default configurations—which is the exact direct cause of the massive impact from the two vulnerabilities in this article.
Complex Dependencies, Lagging Patches:
The Python package ecosystem that AI toolchains depend on is highly complex, and some enterprises take weeks to deploy patches after vulnerability disclosure.
Insufficient Coverage by Security Defense Products:
Traditional EDR has limited detection capabilities for Python process behaviors within AI toolchains, causing anomalous behaviors to often be overlooked.
The policy signal from CNNVD's special cataloging is also worth noting: national agencies putting AI supply chain security under normalized monitoring means compliance pressure will follow—security teams in financial, energy, and critical infrastructure sectors must prepare quantifiable proof of their AI toolchain security defenses in advance.
Langflow: High-Value Target, Attack Surface Fully Open
Langflow is an AI application development platform based on visual workflow orchestration, allowing users to connect LLMs (like GPT-4, Claude, Llama), databases, API interfaces, and Python code nodes into executable AI workflows via drag-and-drop. Because of its extremely low barrier to AI application development, Langflow is widely adopted during the rapid wave of enterprise AI application implementation, especially concentrated in:
AI R&D Teams:
Used for rapid prototyping and internal tool developmentAI Foundational Platforms:
Some enterprises use Langflow as the orchestration layer for internal AI services, hosting workflows connected to multiple business systemsAI Capability Output Nodes:
Providing AI services externally through public Flows, exposed to the public internet
Langflow's architecture naturally makes it a high-value attack target:
High Execution Environment Privileges:
Code nodes in Langflow workflows run directly in the server's Python runtime; getting RCE is equivalent to controlling the entire host machine.
Concentrated Connection Credentials:
A typical Langflow instance stores enterprise OpenAI API Keys, database connection strings, and third-party SaaS access credentials.
Sensitive Network Position:
Langflow deployed in enterprise internal networks or cloud environments often has network permission to access internal systems, making it an ideal springboard for lateral movement.
CVE-2026-33017: No Need to Knock, Go Straight to the Kitchen (Unauthenticated RCE)
Vulnerability Overview
Vulnerability Mechanism (T1190 — Exploit Public-Facing Application)
Langflow offers a "Public Flow" feature, allowing users to create AI workflows that can be executed without authentication. The corresponding build endpoint is:
This endpoint is designed to let visitors run a specified Flow using flow data stored in the database. However, the vulnerability lies in: when the request contains the optional data parameter, the endpoint will prioritize using the flow data provided by the attacker instead of the original database data.
Langflow's Flow data structure allows embedding arbitrary Python code inside node definitions. An attacker only needs to construct a flow data block containing malicious Python code and submit it via the endpoint above to trigger exec() execution on the server side—no authentication, no sandbox, no filtering of any kind.
Saixun Security Lab Analysis Notes
During our independent replication of this vulnerability, Saixun Security Lab noticed a fundamental difference compared to CVE-2025-3248 (/api/v1/validate/code endpoint) which was previously fixed by Langflow: the fix for CVE-2025-3248 was to add authentication checks to the /validate/code endpoint, but the development team failed to apply the same authentication logic to the /build_public_tmp endpoint—this endpoint is designed to serve public Flows, hence requiring no authentication by default, creating an obvious blind spot in patch coverage.
Why is the threat so massive
The combination of arbitrary code + no authentication means: anyone on the internet who finds a public-facing Langflow instance can execute server commands without an account or an API Key. Sysdig's threat research team recorded that within 20 hours after the vulnerability was publicly disclosed, attackers began scanning and exploiting this vulnerability at scale, targeting enterprise internal Langflow deployments and cloud AI service nodes.
This speed is also the direct reason why CISA urgently added it to the KEV (Known Exploited Vulnerabilities Catalog), requiring US federal agencies to complete remediation within 14 days.
CVE-2026-5027: NVD Rated "High," Actual Severity Surpasses "Critical"
Vulnerability Overview
⚠ Why NVD's PR:L (Low Privilege Required) Description is Misleading
NVD flags the CVSS vector of CVE-2026-5027 as PR:L (Privileges Required: Low), implying that attackers need at least a low-privileged account to exploit this vulnerability. However, Saixun Security Lab's analysis revealed the same key fact:
Langflow has the auto-login feature enabled under factory default settings. Attackers only need to send a GET request without any credentials to the /api/v1/auto_login endpoint to get a valid JWT access token. This means:
Combined with the path traversal vulnerability, CVE-2026-5027 has no substantial difference from "Unauthenticated" in the vast majority of production deployments. The complete exploit chain is as follows:
Vulnerability Root Cause: Code-Level Analysis (T1548 – Abuse Elevation Control Mechanism)
Saixun Security Lab located the same root-cause code. The vulnerability is located in:
This function directly extracts the filename passed by the client from the multipart form data, without performing any path security processing:
The result of folder_path / “../../../etc/crontab” is the absolute path /etc/crontab. Python's pathlib will not prevent this kind of path traversal.
Vulnerability Root Cause: Code-Level Analysis (T1548 – Abuse Elevation Control Mechanism)
Why the 1.8.2 Patch is Insufficient
The fixed version for CVE-2026-33017 is 1.8.2, while the affected versions for CVE-2026-5027 extend to 1.8.4. This means:
Enterprises that have upgraded Langflow to 1.8.2 or 1.8.3 remain completely exposed to the attack surface of CVE-2026-5027 even though CVE-2026-33017 is fixed.
Screenshot of Saixun Security Lab reproducing CVE-2026-5027
Can Your Defensive System Block These Two Vulnerabilities?
Whether a vulnerability exists is one thing; whether it can be exploited is another; and whether your defenses can block it is a different matter altogether.
The typical process for most enterprises handling new vulnerabilities is: see disclosure → assess if assets are affected → push patches → consider the issue resolved. This process ignores a critical part: when your application cannot be upgraded or patched immediately due to various objective reasons, can your defense tools like WAF, EDR, and DS detect and intercept real attack payloads targeting these two vulnerabilities?
Saixun Intelligence Security Validation Platform answers exactly this question.
Saixun Security Lab: Transition Path of Product Validation Rules
After finishing independent analysis and replication of CVE-2026-33017 and CVE-2026-5027, Saixun Security Lab converted the exploit chains into security validation rules that can run in customers' real environments, and added them to the attack library of Saixun Intelligence Security Validation Platform. This conversion process includes:
Intelligence Gathering:
Tracking multi-source intelligence such as NVD, CISA KEV, Tenable Advisory, and GitHub PoC repositories (Yahia Hamza, EQSTLab)Vulnerability Replication:
Setting up affected versions of Langflow in the lab environment to fully replicate the exploit chains of both vulnerabilitiesCode-Level Root Cause Analysis:
Locating the upload_user_file() function in langflow/api/v2/files.py and the authentication logic defects in the /build_public_tmp endpointValidation Rule Construction:
Packaging real attack payloads into Saixun Intelligence Security Validation Platform rules, supporting execution in customers' real production defensive environments and automatically judging interception results
Saixun Intelligence Security Validation Platform's Current AI Vulnerability Validation Capabilities
For AI infrastructure security, Saixun Intelligence Security Validation Platform has constructed a security validation rule database covering 10 AI-related applications and 40+ vulnerabilities:
Core Questions Validated by Saixun Intelligence Security Validation Platform
Regarding CVE-2026-33017 and CVE-2026-5027, after executing validation in customers' real environments, Saixun Intelligence Security Validation Platform can accurately tell the security team:
Did the WAF intercept the code injection payload inside the malicious flow data? (CVE-2026-33017)
Did the WAF recognize the ../ sequence in the path traversal attack? (CVE-2026-5027)
Did the EDR detect anomalous commands executed by the Python process? (Post-exploitation phase of CVE-2026-33017)
Did the DS detect anomalous calls to the auto_login endpoint and correlate them with subsequent file upload activities? (CVE-2026-5027)
Did the SIEM generate the corresponding alert, and is the alert timestamp accurate?
Why Patches are Not Enough
After the patch is applied, are there any residual Cron tasks or Webshells that need to be cleared?
Validation with Saixun Intelligence Security Validation Platform can preserve the environment to help security teams confirm whether the patched environment is thoroughly cleaned.There are more than just these two AI toolchain vulnerabilities.
CNNVD's five issues of bulletins collected 974 AI vulnerabilities, and enterprises cannot manually track each one. The attack library of Saixun Intelligence Security Validation Platform is continuously updated, automatically translating the latest threat intelligence into executable validation rules, ensuring enterprise defensive capabilities evolve in sync with threats.
Action Recommendations
For Enterprises with Langflow Deployed
Upgrade to Langflow 1.8.5 or higher immediately:
Note: Upgrading to 1.8.2 only fixes CVE-2026-33017; CVE-2026-5027 affects up to 1.8.4, so you must upgrade to 1.8.5+Disable auto-login immediately:
Set the environment variable LANGFLOW_AUTO_LOGIN to false, which is the fastest mitigation measure to block the default unauthenticated exploit chain of CVE-2026-5027Check Public Flow Configurations:
Confirm whether any Flows are set to unauthenticated public access, and assess the exposure surface of CVE-2026-33017Audit Cron Tasks and Filesystems:
Check paths like /etc/crontab and /etc/cron.d/ for suspicious entries to inspect if they have been exploited by CVE-2026-5027 to plant persistent tasksRotate All Credentials:
Rotate OpenAI API Keys, database connection passwords, and third-party SaaS access credentials stored in Langflow
For Security Teams Wishing to Validate Defensive Effectiveness:
Contact Saixun Technology to use the Saixun Intelligence Security Validation Platform to verify your existing defensive system's actual interception capabilities against CVE-2026-33017 and CVE-2026-5027 in your real environment. Let Saixun Intelligence Security Validation Platform try it for you first before the attackers do.
Vulnerability Technical Indicators (IOC)
