Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Critical Langflow Vulnerability Exploited for Malicious Code Execution
Threat Actors
Excerpt
A critical path traversal vulnerability in Langflow, a widely used open-source low-code platform for building AI-powered applications , is now being actively exploited in the wild. Tracked as CVE-2026-5027 with a CVSS score of 8.8, the flaw enables attackers to write files to arbitrary locations on the filesystem and achieve remote code execution without requiring valid credentials. CVE-2026-5027 resides in Langflow’s POST /api/v2/files endpoint, where the filename…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Attack Flow5 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-5027 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-33017 | High | Score 67/100 | First seen |
| CVE | CVE-2025-34291 | Medium | Score 54/100 | First seen |
| CVE | CVE-2026-21445 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-0770 | Medium | Score 59/100 | First seen |
IOC Relationship Graph
Building graph…