CVE

CVE-2026-21445

View on NVD ↗

Langflow Missing Authentication on Critical API Endpoints

Exploitation IoCs 3

Filename bhup.php
IP 103[.]207[.]14[.]220
IP 45[.]207[.]216[.]55

MITRE ATT&CK TTPs 4

T1059.004
Unix Shell
Execution
 T1105
Ingress Tool Transfer
Command And Control
 T1190
Exploit Public-Facing Application
Initial Access
 T1505.003
Web Shell
Persistence

Source Articles

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
CISA has added four actively exploited vulnerabilities in Adobe ColdFusion, Joomla Page Builder, and Langflow to its Known Exploited Vulnerabilities (KEV) catalog. Exploitation of these flaws, including path traversal and improper access control, has been observed in the wild, leading to remote code execution and unauthorized access. Attackers have deployed web shells and targeted AI orchestration platforms to steal credentials, with activity linked to opportunistic, financially motivated campaigns. Federal agencies are urged to patch by July 10, 2026.
hacker-news Jul 8, 2026