7,000 Langflow Servers Under Active Attack as Researchers Find the Same RCE Hole in LangGraph and LangChain

Three Frameworks, Three Bugs, One Outcome

If your organization has shipped an AI agent to production in the last year, there is a real chance it runs on one of three frameworks that researchers have now confirmed can be exploited for remote code execution. Langflow, LangGraph, and LangChain are not niche tools. They are collectively the scaffolding under a large share of the AI agent deployments running in enterprise environments right now.

According to VentureBeat's June 19 reporting, the three vulnerabilities were documented separately by Check Point Research, Tenable, VulnCheck, and Cyera. They are distinct bugs in distinct codebases. The end state is the same: an attacker with a shell on the box that holds your OpenAI API key, database credentials, and CRM tokens.

The LangGraph Chain: SQL Injection to Python Shell

Yarden Porat of Check Point Research dissected LangGraph's persistence layer, the checkpointer system that gives AI agents memory across sessions. LangGraph has cleared 50 million downloads a month.

Porat identified CVE-2025-67644, rated CVSS 7.3. The vulnerability lives in the SQLite checkpointer's WHERE clause builder. User-controlled filter keys get dropped directly into the SQL query with no parameterization and no escaping. A deployment is exposed when it self-hosts LangGraph on the SQLite or Redis checkpointer and allows untrusted input to reach `get_state_history()` or a comparable history endpoint. Deployments running on LangChain's managed LangSmith platform with PostgreSQL are NOT affected.

The SQL injection alone is bad. What makes it critical is what comes next. CVE-2026-28277, rated CVSS 6.8, is a flaw in LangGraph's msgpack checkpoint decoder. That decoder rebuilds Python objects from stored data, including the ability to import a module and call a named function with attacker-supplied arguments. The SQL injection grants write access to the checkpoint store. The decoder then loads the forged row as a legitimate checkpoint. The result: arbitrary code execution, including `os.system`, running under the agent's own process identity.

Both steps were sitting in production code.

Langflow: Active Exploitation, 7,000 Exposed Servers

The Langflow situation is past the theoretical stage. Tenable and VulnCheck tracked a path traversal vulnerability in Langflow's file upload endpoint, according to VentureBeat. That flaw leads to active, in-the-wild remote code execution. The number of exposed servers sitting under active attack as of June 19, 2026 is approximately 7,000.

Path traversal is not an exotic bug class. It is on every standard vulnerability checklist. The fact that it reached a production file upload endpoint in a framework handling enterprise AI agent workloads represents a straightforward failure of secure development practice.

LangChain: Your Secrets, Off Disk

Cyera documented a path traversal in LangChain-core's prompt loader. Unlike the LangGraph chain, this one does not necessarily produce a shell. What it does produce is a read of secrets off disk, including API keys and configuration files that the agent process can access. For a framework that sits between your agents and your databases, CRMs, and internal APIs, that exposure is material.

The Structural Problem These Bugs Reveal

The counterargument: these are complex, fast-moving open-source frameworks built by small teams trying to ship useful software. SQL injection and path traversal are well-understood bug classes, but security review takes time and resources that early-stage frameworks rarely have. Frameworks should not be expected to be hardened enterprise products the moment they hit production adoption.

The problem is that these frameworks did not stay in the early-adopter sandbox. They went straight to production infrastructure, storing agent state, handling file uploads, loading prompt configs, and holding credentials to live systems. That happened faster than anyone secured them. The security tooling, endpoint detection, network monitoring never treated an imported AI framework as a boundary worth guarding.

Small teams building fast is not a moral failure. Shipping credential-holding, shell-accessible infrastructure without parameterized queries and path validation is an operational risk that organizations deploying these frameworks own right now.

What Needs to Happen

The immediate exposure conditions for LangGraph require self-hosting on SQLite or Redis with untrusted input reaching history endpoints. Organizations should audit whether those conditions exist in their deployments before anything else. Migrating to managed infrastructure that enforces PostgreSQL isolation eliminates the SQL injection vector.

For Langflow, 7,000 servers under active attack means patching is not a planning item. Specific patch versions were not confirmed in the single source available for this report; organizations should treat the Tenable and VulnCheck advisories as the authoritative patch guidance.

For LangChain-core, the Cyera advisory on the prompt loader path traversal is the reference document. Secret rotation for any credentials accessible to LangChain agent processes should happen in parallel with patching.

The unresolved question, as of June 19, 2026, is how many of the 7,000 exposed Langflow servers have already been successfully compromised, and whether credentials exfiltrated from those boxes are already in circulation. Neither Tenable nor VulnCheck had published that count in the material available to this report.