CVE

CVE-2026-5027

View on NVD ↗

Langflow - Path Traversal Arbitrary File Write via upload_user_file

Exploitation IoCs 6

Domain canary
Filename .bash_history
Filename .sysd
Filename /root/.cache/langflow/secret_key
IP France
IP Israel

MITRE ATT&CK TTPs 8

T1003
OS Credential Dumping
Credential Access
 T1021
Remote Services
Lateral Movement
 T1059.003
Windows Command Shell
Execution
 T1071.001
Web Protocols
Command And Control
 T1083
File and Directory Discovery
Discovery
 T1190
Exploit Public-Facing Application
Initial Access
 T1485
Data Destruction
Impact
 T1566
Phishing
Initial Access

Source Articles

Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are actively exploiting two critical vulnerabilities, CVE-2026-0768 in Langflow and CVE-2026-66066 (KindaRails2Shell) in Ruby on Rails, to conduct credential probing, remote code execution, and command-and-control activities. Exploitation of CVE-2026-66066 involves uploading a crafted image to read sensitive files, leak environment secrets, and achieve RCE, particularly when libvips is used for image processing. Attackers have targeted canary systems globally, with source traffic traced to Russia and a single IP in France, and C2 infrastructure in Israel. Additional post-exploitation activities include deploying credential harvesters, cryptominers, disabling auditd, and lateral movement.
hacker-news Sep 1, 2026