Critical security flaws in LangGraph, Langflow, and LangChain expose 7,000+ servers to remote code execution
By
Louis Columbus
Summary
Check Point Research, Tenable, VulnCheck, and Cyera have discovered that three major AI agent frameworks — LangGraph, Langflow, and LangChain — contain critical security vulnerabilities (SQL injection and path traversal) that are being actively exploited in the wild. These flaws allow attackers to achieve remote code execution on servers holding sensitive credentials like OpenAI keys, database credentials, and CRM tokens. The vulnerabilities exist below the layer where most security tools monitor, making them particularly dangerous. An estimated 7,000+ servers are exposed.
Source
bskyCritical security flaws in LangGraph, Langflow, and LangChain expose 7,000+ servers to remote code executionventurebeat.comKey quotes
· 4 pulledYour AI agent did exactly what it was designed to do. The framework underneath it just handed an attacker a shell on the box that holds your OpenAI key, your database credentials, and your CRM tokens.
In a few months, three of the most widely deployed AI agent frameworks each turned a known, ordinary bug class into a way through.
Check Point Research chained a SQL injection in LangGraph's SQLite checkpointer to full remote code execution.
Tenable and VulnCheck tracked a path traversal in Langflow's file upload endpoint to active, in-the-wild RCE.
You might also wanna read
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Critical LangChain Core Vulnerability (CVE-2025-68664) Allows Serialization Injection Attacks
Cyata Research discloses LangGrinch (CVE-2025-68664), a critical vulnerability in LangChain Core that allows serialization injection attacks
cyata.ai·6mo ago
Security Analysis: AI Agent Frameworks' Code Execution Vulnerabilities and WASM Sandbox Solution
The article discusses security vulnerabilities in popular AI agent frameworks like LangChain, AutoGen, and SWE-Agent that execute LLM-genera
github.com·5mo ago
Security Risks of Malicious Backdoors in Large Language Models
The article explores the security risks associated with Large Language Models (LLMs), particularly the potential for embedding malicious bac
pub.aimind.so·10mo ago
AI Coding Agent Security: Prompt Injection Attacks and Vulnerabilities
The article discusses critical security vulnerabilities in AI coding agents, specifically focusing on prompt injection attacks. It details r
openguard.sh·3mo ago
Security Risks of Large Language Models and Coding Agents Revealed at Black Hat
The article discusses the security risks associated with the increasing use of Large Language Models (LLMs) and coding agents, highlighting
garymarcus.substack.com·10mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.