7,000 Langflow servers are under attack. Lang Graph and Lang Chain have the same holes | Venture Beat

Overview

7,000 Langflow servers are under attack. Lang Graph and Lang Chain have the same holes

Your AI agent did exactly what it was designed to do. The framework underneath it just handed an attacker a shell on the box that holds your Open AI key, your database credentials, and your CRM tokens.

Details

That is not a hypothetical. In a few months, three of the most widely deployed AI agent frameworks each turned a known, ordinary bug class into a way through. Check Point Research chained a SQL injection in Lang Graph’s SQLite checkpointer to full remote code execution. Tenable and Vuln Check tracked a path traversal in Langflow’s file upload endpoint to active, in-the-wild RCE. Cyera documented a path traversal in Lang Chain-core’s prompt loader that reads your secrets off disk. Two paths to a shell, one to your keys. They are the same bug, wearing three frameworks.

These frameworks became production infrastructure faster than anyone secured them. They store agent state, take file uploads, load prompt configs, and hold the credentials to databases, CRMs, and internal APIs. The edge tools watch traffic. The endpoint tools watch processes. Neither was built to treat an imported framework as a boundary worth guarding, and that blind spot is exactly where all three chains live, widening every week as these frameworks ship to production.

The Lang Graph chain, SQL injection to a Python shell

Start with the one most teams pulled into production this quarter. Lang Graph gives AI agents memory through checkpointers, the persistence layer that stores execution state. It has cleared over 50 million downloads a month. Yarden Porat of Check Point Research took that layer apart and found three vulnerabilities. Two of them chain to RCE.

CVE-2025-67644, rated CVSS 7.3, is a SQL injection in the SQLite checkpointer. The function that builds the WHERE clause for checkpoint lookups drops user-controlled filter keys straight into the query with no parameterization and no escaping. This does not hit everyone, but where it hits, it is serious. A deployment is exposed when it self-hosts Lang Graph on the SQLite or Redis checkpointer and lets untrusted input reach get_state_history() or a similar history endpoint. Meet those conditions, and an attacker who controls the filter writes a fabricated row straight into the checkpoint table. Run Lang Chain’s managed Lang Smith platform on Postgre SQL, and the exposure is gone.

Then CVE-2026-28277, CVSS 6.8, finishes the job. Lang Graph’s msgpack checkpoint decoder rebuilds Python objects from the stored data, which lets it import a module and call a named function with attacker-supplied arguments. That step needs write access to the checkpoint store; the SQL injection is what grants it remotely. Lang Graph loads the forged row as a legitimate checkpoint, the decoder runs the specified function, including os.system, and code executes under the identity of the agent server. A third issue, CVE-2026-27022, CVSS 6.5, reaches the same place through the Redis checkpointer.

There has been no confirmed exploitation in the wild yet. A working proof-of-concept is public in Check Point’s disclosure. The fixes are version bumps: langgraph-checkpoint-sqlite to 3.0.1, langgraph to 1.0.10, and langgraph-checkpoint-redis to 1.0.2.

The Langflow chain, one unauthenticated request to RCE

The timeline is what sets the clock. The patch shipped April 15. Attacks started in June, and Vuln Check added CVE-2026-5027 to its exploited-vulnerabilities list June 8 once its sensors caught the first in-the-wild hits. Every instance left unpatched between those two dates has been sitting in the open for almost two months. The lesson for security teams is to start the patch clock at disclosure, not at a federal catalog entry.

The Lang Chain-core gap, arbitrary file reads through the prompt loader

Lang Chain-core, the foundation under both, disclosed CVE-2026-34070, CVSS 7.5, a path traversal in its legacy prompt-loading API. The load_prompt() functions read a file path out of a config dict with no check against traversal sequences or absolute paths, so an attacker who influences that path reads arbitrary files the process can reach, including the .env file holding OPENAI_API_KEY and ANTHROPIC_API_KEY. Cyera paired it with CVE-2025-68664, CVSS 9.3, a deserialization flaw that resolves environment secrets through a crafted object. The fix versions differ, which matters when you patch: CVE-2026-34070 lands in langchain-core 1.2.22 and 0.3.86; CVE-2025-68664 lands earlier in 1.2.5 and 0.3.81. Clear both, or the higher-severity flaw stays live behind a patched one.

Three frameworks, three classic App Sec bugs. Path traversal. SQL injection. Unsafe deserialization. Nothing exotic, nothing AI-specific, just old vulnerabilities living inside new infrastructure. None of this is a frontier-model problem. It is plumbing, sitting in the layer where AI meets the enterprise.

Merritt Baer, CSO at Enkrypt AI and former deputy CISO at AWS, has named what makes this kind of failure hard to see coming. It does not announce itself as an AI problem. "CISOs will experience MCP insecurity not in the abstract, but when an employee pastes sensitive data into a tool, or when an attacker finds an unauthenticated MCP server in your cloud," Baer told Venture Beat. "It won't feel like 'AI risk.' It will feel like your traditional security program failing." The framework chains here are the same shape. An exposed Langflow instance is an unauthenticated server in your cloud, and the alert, if one fires, reads like an ordinary incident.

That is the gap in one sentence. The exploit lives in the framework your code imports. The WAF never sees a msgpack decoder running three layers down. The EDR watches the agent server make the same process calls it makes a thousand times a day and waves it through. Both tools are doing their job. Nobody scoped the framework itself as the thing that could turn on you.

There is a governance failure layered on top of the technical one, and it is the same miscategorization Assaf Keren, chief security officer at Qualtrics and former CISO at Pay Pal, has flagged in adjacent tooling. “Most security teams still classify experience management platforms as ‘survey tools,’ which sit in the same risk tier as a project management app,” Keren told Venture Beat. “This is a massive miscategorization.” Swap in AI agent frameworks, and it still holds. Teams file Lang Graph, Langflow, and Lang Chain under developer convenience, then wire them into databases, CRMs, and provider keys. “Security has to be an enabler,” Keren said, “or teams route around it.” These frameworks are what routing around it looks like.

Follow the money and it points at the same layer. On its Q1 fiscal 2027 earnings call, Crowd Strike reported its AI detection and response line up more than 250% sequentially, and on June 17 it extended that runtime coverage to agent, LLM, and MCP traffic on AWS. George Kurtz, the company’s co-founder and CEO, named the reason in plain terms: “Agents run on the endpoint. They make tool calls, access files, invoke APIs, and move data at the process level.” That is the exact plumbing these chains abuse, and real money is now moving to the layer your App Sec scan skips.

The board does not need the CVE numbers. It needs the consequence, and Keren draws the line the board cares about. Most teams have mapped the technical blast radius. “But not the business blast radius,” Keren told Venture Beat. “When an AI engine triggers a compensation adjustment based on poisoned data, the damage is not a security incident. It is a wrong business decision executed at machine speed.” A framework RCE is the same problem one layer earlier. The agent does not just leak a credential; it acts on production systems with it, and the business sees an outcome no one can explain.

So frame it the way a board frames it: we run AI agent frameworks in production that can be turned into remote shells through bugs our scanners are not built to find, all three are patched, one is under active attack, and here is the date every instance is verified and closed. None of this required custom malware or a zero-day.

Six trust boundaries, one per row, each with the question, the proof point, the command, the fix, and the board line. Run it tonight.

Can the agent's state store be poisoned with code?
Can the agent's state store be poisoned with code?

Lang Graph SQLi-to-RCE chain. CVE-2025-67644 (CVSS 7.3) chains into CVE-2026-28277 (CVSS 6.8). Po C public, no in-the-wild use yet.

Filter keys interpolated into SQL with an f-string. Forged checkpoint row hits the msgpack decoder, which imports and runs an attacker-named callable.

pip show langgraph-checkpoint-sqlite. Below 3.0.1 = vulnerable. Confirm get_state_history() is not exposed to network input.

Upgrade langgraph-checkpoint-sqlite to 3.0.1, langgraph to 1.0.10, langgraph-checkpoint-redis to 1.0.2.

“Our agent memory layer can be tricked into running attacker code. Vendor has patched it. We are upgrading and confirming the endpoint is not exposed.”

Can an unauthenticated request write a file to our agent server?
Can an unauthenticated request write a file to our agent server?

Langflow CVE-2026-5027 (CVSS 8.8). On Vuln Check KEV (June 8). Active exploitation confirmed June 9. ~7,000 exposed instances (Censys).

Can our prompt loader read files it should never touch?
Can our prompt loader read files it should never touch?

Lang Chain-core CVE-2026-34070 (CVSS 7.5), path traversal in the prompt-loading API. Paired with deserialization CVE-2025-68664 (CVSS 9.3).

load_prompt() reads a config-supplied path with no traversal check, returning files such as the .env holding OPENAI_API_KEY and ANTHROPIC_API_KEY.

pip show langchain-core. Below 1.2.22 (1.x) or 0.3.86 (0.x) = vulnerable. Audit any code passing user-influenced paths to load_prompt().

Upgrade langchain-core past both fixes: 1.2.22 / 0.3.86 (CVE-2026-34070) and 1.2.5 / 0.3.81 (CVE-2025-68664). Replace load_prompt() with an allowlisted directory. Run as non-root.

“Our prompt system could be steered to read our API keys off disk. We are patching and removing the legacy loader.”

Does a compromised framework hand over every credential at once?
Does a compromised framework hand over every credential at once?

These frameworks are often deployed with provider keys, database credentials, and integration tokens available to the process environment. Cyera documents the credential-exfiltration path.

One RCE on the agent server exposes every secret the process can read. Blast radius is the full credential set, not one app.

Inventory which secrets each framework process can reach. Confirm keys come from a secrets manager, not static .env files.

Move provider keys to ephemeral injection. Rotate any key a vulnerable instance could have read. Scope each key to least privilege.

“A single break in one AI framework exposes the keys to every model and data store it touches. We are rotating and scoping them now.”

Are these frameworks running outside security governance?
Are these frameworks running outside security governance?

A prior Langflow flaw, CVE-2025-34291, was weaponized by Iranian-linked Muddy Water and added to CISA KEV in May. Shadow AI is the new shadow IT.

Teams stand frameworks up for speed, give them credentials, and never bring them under review. The security team cannot see what it does not know exists.

Run a discovery sweep for AI frameworks outside change management. Map each to an owner and an approval record.

Assign every framework a documented owner and a place in the approval process. Offer a sanctioned alternative so teams do not route around you.

“We have AI frameworks in production that no one formally approved. We are bringing them under governance, not banning them.”

Can our scanners even see inside the framework at runtime?
Can our scanners even see inside the framework at runtime?

Runtime detection is forming around this layer: Crowd Strike Falcon AIDR expanded to AWS June 17 (Bedrock, Kiro, Strands); its Quilt Works coalition now covers cloud workloads.

WAF reads HTTP at the edge. EDR watches the endpoint. By default, neither reliably models a msgpack decoder or a prompt loader three layers down in an imported framework as a separate trust boundary.

Test whether your App Sec scan covers third-party framework internals. Track CVEs by dependency, not just by what your edge tools can parse.

Add framework dependencies to vuln management. Treat agent output and stored state as untrusted. Patch on disclosure, not on KEV listing.

“Our scanners check our code, not the frameworks our code imports. We are closing that blind spot and patching on disclosure, not waiting for the federal catalog.”

How to read this table: each row is one trust boundary, left to right, from the question to ask to the line to read your board.

Deep insights for enterprise AI, data, and security leaders

By submitting your email, you agree to our Terms and Privacy Notice.

Key Takeaways

7,000 Langflow servers are under attack
Your AI agent did exactly what it was designed to do
That is not a hypothetical
These frameworks became production infrastructure faster than anyone secured them
The Lang Graph chain, SQL injection to a Python shell