Langflow Flaws Exposed AI Servers to Takeover

Anyone with a link to a shared Langflow chatbot could take full control of its server and grab stored credentials, internal databases and other connected systems. Rubrik Zero Labs found this flaw, along with three others, in the artificial intelligence development platform.

See Also: Edge Transformation: Top 5 SASE Predictions and Trends

Langflow allows developers to build AI applications by dragging together pre-built blocks instead of writing code from scratch. Rubrik reported the Langflow issues to the project’s maintainers in February, who finished patching the flaws in May.

The most severe bug resided in a feature allowing Langflow users to publish a chatbot as a public link so anyone could chat with it. Rubrik found that every request sent through Langflow’s public chat interface included the AI application’s entire blueprint, including the Python code behind each component. By modifying that blueprint before sending it back, Rubrik was able to run arbitrary code on the server without needing an account or password. The bug is tracked as CVE-2026-48519.

Another critical flaw, which Rubrik named RAGPull, worked through document uploads. Langflow allows users to upload documents, including compressed archives, so a chatbot can search across them, an approach known as retrieval-augmented generation. Rubrik found that Langflow’s document parser would follow shortcut files called symlinks, hidden inside uploaded archives, reading whatever file the shortcut pointed to instead of the archive’s real contents.

By uploading an archive with a symlink pointing to a file that stores a server’s hidden settings, including its administrator password, the team pulled those credentials into the chatbot’s document database, then asked the chatbot for them. The flaw is tracked as CVE-2026-7524.

“Our RAGPull finding allowed us to feed a malicious document through RAG, which in turn allowed us to read arbitrary files and ultimately reach remote code execution without ever attacking the model directly,” said Ori Lahav, principal security researcher at Rubrik Zero Labs.

A third flaw allowed anyone, without logging in, to fill Langflow’s storage with files and reveal the server’s file path. It’s tracked as CVE-2026-7528.

A fourth, related bug allowed unauthenticated users to feed local files into the AI model. Rubrik did not fully exploit it, but said it could also lead to remote code execution. It’s tracked as CVE-2026-48520.

The findings are the first of a series covering vulnerabilities Rubrik found across Langflow, n8n and Activepieces, three widely used AI orchestration platforms. Lahav said the vulnerabilities in the platforms betray a systemic lack of concern about security. “Any single finding can read like an implementation flaw, but when you bundle the three platforms together, a pattern emerges,” he told ISMG. “It’s less that each vendor made the same mistake and more that the whole category is being built and shipped at a pace that may neglect the fundamentals.”

What struck Lahav’s team most was how ordinary the underlying bugs were. “Almost none of them were AI-specific,” he said. “They were infrastructure and classic web-application vulnerabilities.” He said the AI branding of these tools can obscure how much conventional infrastructure sits underneath. “People picture AI as just the large language model, but they don’t see everything the LLM is wired into, like file systems, databases and internal systems,” Lahav said. “That’s where the real exposure is.”

Lahav said organizations that cannot patch immediately still have options, though upgrading is the best fix. In the meantime, a reverse proxy can add an authentication layer in front of Langflow and inspect incoming requests before they reach the application, though it also adds deployment complexity, he said. He cautioned against relying on any single sign of compromise, saying each of the platform vulnerabilities leaves different traces on the network and in the file system. “Defenders shouldn’t expect a clean, universal indicator of compromise to result from this research,” Lahav said.

Rubrik did not scan for exposed, vulnerable Langflow deployments before disclosure, but Lahav expects the exposure to be significant. “All three of the platforms we investigated are widely used, and all have both cloud and self-hosted offerings, so there are likely many vulnerable targets in total,” he said.

Rubrik said it will detail the vulnerabilities it found in n8n and Activepieces in upcoming blogs.