Langflow Flaws: AI Servers Vulnerable to Takeover

Serious security flaws in the AI development platform, Langflow, exposed AI servers to complete takeover. Researchers found that anyone with a link to a shared Langflow chatbot could gain full control of its server. This allowed access to stored credentials, internal databases, and other connected systems. Rubrik Zero Labs discovered these four critical vulnerabilities. One severe bug, tracked as CVE-2026-48519, let attackers run arbitrary code on a server without needing an account. This was possible by modifying a chatbot's blueprint, which was exposed through its public chat interface. Another critical flaw, named RAGPull and tracked as CVE-2026-7524, involved document uploads. Attackers could upload archives containing shortcut files, called symlinks, to access sensitive server settings, including administrator passwords. Two other bugs, CVE-2026-7528 and CVE-2026-48520, allowed unauthenticated users to fill storage with files, reveal server file paths, and feed local files into the AI model. These could also lead to remote code execution. Rubrik reported these issues in February, and the flaws were patched by May. This discovery highlights a significant lack of fundamental cybersecurity in AI platforms.