CVE-2026-7524Disclosure(langflow / langflow)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

Patch langflow langflow systems immediately
Hunt for exploitation attempts and persistence artifacts

Recommended action window: High priority (within 72h)

NVD description

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

langflow CVEs Back to dashboard

2.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.ibm.com/support/pages/node/7273426

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

langflow

Threat summary

Exploit tooling references are present in monitored signal
Patch or workaround signal is available
11 mentions across 8 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 2 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 10 signals
Disclosure: 3 classified signals
General: 3 classified signals
Peaked 4d ago at 2 mentions (2026-06-14); latest day: 2
11 total mentions across 8 days

Affected systems

Vendors

langflow

Products

langflow

Deep dive

Activity timeline11 mentions / 8d

Signal classification4 categories

Disclosure

327.3%

Exploit

327.3%

General

327.3%

Patch

218.2%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-27	1	Patch1
2026-05-28	1	Patch1
2026-05-29	1	Disclosure1
2026-06-14	2	Exploit1General1
2026-06-15	2	Disclosure1Exploit1
2026-06-20	1	Exploit1
2026-07-01	1	Disclosure1
2026-07-13	2	General2

Full discourse11 posts

YogSotho@YogSoth0113d
Exploit
🚨 #Langflow Multi-CVE Exploit Kit 💡 **CVE-2026-7524 (Path Traversal) | CVE-2026-7700 (Lambda eval) | CVE-2026-7687 (CodeParser CMD Injection)** 🧬 **Multi-Vector RCE Exploitation Framework** 😈 **Exploitation Chain:** 1. Create tar.gz with payload file + symlink pointing to target path (e.g., `../../../../tmp/shell.jsp`) 2. Upload to any vulnerable endpoint (`/api/v1/upload/archive`, `/api/v1/docling/`, etc.) 3. Archive extraction follows symlink → writes webshell to web root 4. Access webshell for persistent RCE #exploit #0days #security #hacking #CVE #CVSS #Langflow #unleaked
Post summary
The tweet describes a multi-CVE exploitation framework for Langflow, detailing an attack chain but without providing a functional exploit or patch.
218097516.0K
1.8K followersView on X
Gray Hats@the_yellow_fall136d
Patch
A critical Langflow OSS vulnerability (CVE-2026-7524) allows remote code execution. Apply the remote code execution patch to secure your system. #Cybersecurity #Langflow #Vulnerability #Infosec #PatchUpdate #RCE #AIPlatform https://securityonline.info/langflow-oss-vulnerability-cve-2026-7524/ https://t.co/5i0KDb3KAV
Post summary
The post announces that CVE-2026-7524 is a remote code execution flaw in Langflow OSS and urges users to apply the available patch.
11081747
12.5K followersView on X
YogSotho@YogSoth0118d
Exploit
# Langflow Multi-CVE Exploit Kit **CVE-2026-7524 (Path Traversal) | CVE-2026-7700 (Lambda eval) | CVE-2026-7687 (CodeParse> **Military-Grade Multi-Vector RCE Exploitation Framework** #exploit #0days #CVE #CVSS #security #hacking https://t.co/hB4tr07PJW
Post summary
The tweet advertises a multi-CVE exploit kit featuring an RCE exploitation framework for CVE-2026-7524, CVE-2026-7700, and CVE-2026-7687, implying the presence of exploit tools but no evidence of active exploitation or mitigations.
10090366
1.8K followersView on X
YogSotho@YogSoth0120d
Exploit
New 0days multi-exploit kit: Langflow Multi-CVE Reconnaissance Scanner Targets: CVE-2026-7524 (Path Traversal), CVE-2026-7700 (Lambda eval), CVE-2026-7687 (CodeParser) Military-grade async scanner with vulnerability fingerprinting and exploitability scoring. Soon on gibliz 0days
Post summary
A new multi‑exploit kit targeting several 2026 CVEs has been announced, featuring a reconnaissance scanner with vulnerability fingerprinting and exploitability scoring, but no PoC or active exploitation claims are provided.
11031319
1.8K followersView on X
Ori@vbCrLf118d
Disclosure
Over the last few months, I researched Langflow, n8n, and Activepieces. The result is 9 zero-days and a BlueHat IL talk 🛠️ 🚨 CVE-2026-7524 (Critical - 9.8) 🚨 CVE-2026-48519 (Critical - 9.6) ⚠️ CVE-2026-7528 (High - 7.1) 🐛 CVE-2026-42228 (Moderate - 6.3) 🐛 CVE-2026-48520 (Moderate - 6.1) 🚨 CVE-not-yet-published (Critical - 9.0) 🚨 CVE-not-yet-published (Critical - 10.0) ⚠️ CVE-not-yet-published (High - 8.6) ⚠️ CVE-not-yet-published (High - 8.3) Thanks to the vendors for the cooperation and fixes. @Oranav and I will be breaking down some of these on stage at BlueHat IL 2026 Registration closes soon. Write-ups will be published after the con. Abstract: https://www.microsoftrnd.co.il/bluehatil/conference/abstracts#collapse-25 @BlueHatIL @msftsecresponse
Post summary
The post announces nine newly discovered zero‑day vulnerabilities affecting Langflow, n8n, and Activepieces, provides their severity ratings, and notes that vendors have issued fixes while upcoming write‑ups will detail the findings.
11030468
43 followersView on X
Lyrie.ai@lyrie_ai91d
General
Vendor. 0day Intel: 🚨 #Langflow Multi-CVE Exploit Kit 💡 CVE-2026-7524 (Path Traversal) | CVE-202
Post summary
The post references a Multi‑CVE exploit kit targeting CVE‑2026‑7524 (Path Traversal) but provides no PoC, exploit code, or evidence of active attacks.
1000045
310 followersView on X
Lyrie.ai@lyrie_ai91d
General
CVE-2026-7524. 0day Intel: 🚨 #Langflow Multi-CVE Exploit Kit 💡 CVE-2026-7524 (Path Traversal) | CVE-202
Post summary
The snippet only references CVE-2026-7524 as a path traversal vulnerability with no further details, links, or actionable information.
1000051
310 followersView on X
Rubrik Zero Labs@RubrikZeroLabs102d
Disclosure
CVE-2026-7524 (CVSS 9.8 🔴): "RAGPull" — tar symlink traversal in the document parser → arbitrary file read → read /proc/1/environ → superuser creds → full RCE. All from uploading a malicious archive to a RAG chatbot.
Post summary
CVE‑2026‑7524 is a high‑severity RCE vulnerability in a RAG chatbot’s document parser, enabled by tar symlink traversal that allows an attacker to read sensitive files and obtain superuser credentials.
1000052
26 followersView on X
YogSotho@YogSoth0120d
General
**langflow_multi_cve.zip** | CVE-2026-7524, CVE-2026-7700, CVE-2026-7687
Post summary
The text simply lists three CVE identifiers alongside a zip file name, providing no additional technical or operational information.
00010138
927 followersView on X
VulnTracker@vuln_tracker136d
Disclosure
@the_yellow_fall Your AI pipeline builder has an RCE. CVE-2026-7524 - critical RCE in Langflow OSS. The tool teams use to build LLM workflows just became an entry point. AI platforms are the new attack surface. And they're moving too fast to keep up with patches. http://vulntracker.io
Post summary
The tweet announces the disclosure of a critical remote code‑execution vulnerability (CVE‑2026‑7524) in Langflow OSS, underscoring the urgency of timely patching for AI pipeline builders.
0000199
655 followersView on X
Orizon@OrizonCyber137d
Patch
🚨 CVE-2026-7524 — CVSS 9.8/10 ██████████ IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/LKalsDQ8nc
Post summary
The tweet announces CVE-2026-7524, a critical RCE vulnerability in IBM Langflow caused by improper symbolic link validation, and urges users to apply the available patch immediately.
1000092
43 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	langflow	langflow	-	-	-

Explore more

Back to dashboard langflow CVEs langflow vulnerabilities

What researchers are saying

CVE-2026-7524

YogSotho[verified]@YogSoth0Exploit

The tweet describes a multi-CVE exploitation framework for Langflow, detailing an attack chain but without providing a functional exploit or patch.

YogSotho[verified]@YogSoth0Exploit

The tweet advertises a multi-CVE exploit kit featuring an RCE exploitation framework for CVE-2026-7524, CVE-2026-7700, and CVE-2026-7687, implying the presence of exploit tools but no evidence of active exploitation or mitigations.

YogSotho[verified]@YogSoth0Exploit

A new multi‑exploit kit targeting several 2026 CVEs has been announced, featuring a reconnaissance scanner with vulnerability fingerprinting and exploitability scoring, but no PoC or active exploitation claims are provided.

Ori[verified]@vbCrLfDisclosure

The post announces nine newly discovered zero‑day vulnerabilities affecting Langflow, n8n, and Activepieces, provides their severity ratings, and notes that vendors have issued fixes while upcoming write‑ups will detail the findings.

Lyrie.ai[verified]@lyrie_aiGeneral

The post references a Multi‑CVE exploit kit targeting CVE‑2026‑7524 (Path Traversal) but provides no PoC, exploit code, or evidence of active attacks.

Lyrie.ai[verified]@lyrie_aiGeneral

The snippet only references CVE-2026-7524 as a path traversal vulnerability with no further details, links, or actionable information.

YogSotho[verified]@YogSoth0General

The text simply lists three CVE identifiers alongside a zip file name, providing no additional technical or operational information.

VulnTracker[verified]@vuln_trackerDisclosure

The tweet announces the disclosure of a critical remote code‑execution vulnerability (CVE‑2026‑7524) in Langflow OSS, underscoring the urgency of timely patching for AI pipeline builders.