AI Frameworks Are Handing Out Shells

Your shiny new AI agent is doing exactly what you built it to do. Unfortunately, the framework you built it on just handed an attacker a remote shell, your OpenAI keys, your database credentials, and your CRM tokens.

This is not a drill and it is not a theoretical whitepaper. Right now, three of the most widely deployed AI agent frameworks (Langflow, LangGraph, and LangChain) are actively turning classic, mundane AppSec bugs into full system compromises. Threat actors are already exploiting one of them in the wild and targeting nearly 7,000 exposed instances.

The worst part? Your security tools are completely blind to it.

The Unholy Trinity: Three Paths to Your Keys

We shoved these frameworks into production faster than we secured them. They store agent state, handle file uploads, load prompts, and hold the keys to the kingdom. Now, that technical debt is cashing out.

1. Langflow: Unauthenticated Fast Track to RCE (Active Exploitation)

• The Bug: CVE-2026-5027 (CVSS 8.8)
• The Reality: A path traversal flaw in the POST /api/v2/files endpoint. It writes unsanitized filenames straight to disk. Because Langflow ships with auto-login enabled by default, an attacker needs zero credentials. They just pack a filename with traversal sequences, drop a file into /etc/cron.d/, and wait for the next cron run to hand them a shell.
• The Status: Attackers have been exploiting this in the wild since early June. Censys spots roughly 7,000 exposed instances online.
• The Fix: Upgrade to 1.9.0+. Kill auto-login. Move it behind a VPN.

2. LangGraph: SQLi to Python Shell

• The Bug: CVE-2025-67644 (CVSS 7.3) chained with CVE-2026-28277 (CVSS 6.8).
• The Reality: A classic SQL injection in the SQLite checkpointer lets an attacker forge a checkpoint row. Then, the msgpack decoder steps in and rebuilds Python objects from that forged data. It imports a module, runs attacker-supplied arguments (like os.system), and executes code under the agent server's identity.
• The Status: Proof of concept is public. No wild exploitation confirmed yet.
• The Fix: Bump langgraph-checkpoint-sqlite to 3.0.1 and langgraph to 1.0.10.

3. LangChain-core: Arbitrary File Reads

• The Bug: CVE-2026-34070 (CVSS 7.5) paired with CVE-2025-68664 (CVSS 9.3).
• The Reality: Path traversal in the legacy prompt loading API. An attacker feeds a path through the config, bypasses checks, and reads whatever the process can reach. This includes the .env file holding your OPENAI_API_KEY.
• The Status: Fully documented.
• The Fix: Upgrade to 1.2.22 or 0.3.86 for the traversal, and 1.2.5 or 0.3.81 for the deserialization flaw. Drop load_prompt().

Why Your Scanners Are Blind

If you are waiting for your WAF or EDR to catch this, you are going to be waiting until incident response gets called.

These vulnerabilities do not look like AI risk. They look like normal operations. The exploit lives deep inside the framework your code imported. The WAF just sees normal HTTP traffic. The EDR watches the agent server make the same system calls it makes thousands of times a day and waves it through.

We are shipping AI infrastructure with the same insecure defaults we have been fighting for decades. When you plug an agent into your database, you are inheriting the security hygiene of every tool, dependency, and developer in that framework's supply chain.

The NETTWERKED Action Plan

Stop treating AI developer tools like low-risk survey apps. They are executing commands at machine speed with high-level access. Run this checklist today:

The patches are out. The delay is entirely on you. Start the patch clock at the moment of vendor disclosure, not when it hits a federal catalog. Patch it now.