The current gold rush in AI agent development has shifted the focus from simple prompt engineering to complex orchestration. Developers are rapidly integrating frameworks like LangGraph, Langflow, and LangChain-core to build autonomous systems that can manage state, call tools, and maintain long-term memory. This acceleration has created a precarious environment where the speed of deployment often outpaces the rigor of security audits. While the industry spends most of its time worrying about prompt injection or model hallucinations, a more traditional and dangerous threat has emerged in the plumbing of these AI frameworks.
The Infrastructure of Vulnerability
Recent security disclosures have revealed a series of critical vulnerabilities across three of the most prominent AI orchestration tools, ranging from remote code execution to sensitive data leakage. These flaws are not failures of the underlying large language models but are instead classic infrastructure vulnerabilities found in how the frameworks handle data persistence and file systems. In LangGraph, three distinct vulnerabilities have been identified. CVE-2025-67644 is a SQL injection flaw in the SQLite checkpointer with a CVSS score of 7.3. This is accompanied by CVE-2026-28277, a vulnerability in the msgpack checkpoint decoder with a CVSS score of 6.8, and CVE-2026-27022, which affects the Redis checkpointer and carries a CVSS score of 6.5. To mitigate these risks, the maintainers have released `langgraph-checkpoint-sqlite` 3.0.1, `langgraph` 1.0.10, and `langgraph-checkpoint-redis` 1.0.2.
Langflow faces a severe threat via CVE-2026-5027, which carries a high CVSS score of 8.8. Research conducted by Censys indicates that approximately 7,000 instances of Langflow are currently exposed to the public internet. The timeline of this vulnerability is particularly concerning; while a patch was released in version 1.9.0 on April 15, VulnCheck confirmed active exploitation of the flaw as late as June 9. This gap between the patch release and active exploitation highlights a significant lag in the update cycles of deployed AI infrastructure.
LangChain-core is also under scrutiny with two reported vulnerabilities. CVE-2026-34070 is a path traversal flaw in the legacy prompt loading API with a CVSS score of 7.5. More critical is CVE-2025-68664, a deserialization defect that can expose environment variable passwords, earning a critical CVSS score of 9.3. The fixes for these issues are split across different versions: CVE-2026-34070 is resolved in `langchain-core` 1.2.22 and 0.3.86, while CVE-2025-68664 is addressed in versions 1.2.5 and 0.3.81.
The Mechanics of the Exploit
Understanding the danger requires looking at how these vulnerabilities are chained together to achieve full system compromise. In LangGraph, a sophisticated attacker does not rely on a single flaw but instead uses a two-stage attack. First, the attacker leverages CVE-2025-67644. When the SQLite checkpointer processes history endpoints like `get_state_history()`, it inserts user-supplied filter keys directly into queries without proper parameterization or escaping. This allows an attacker to inject malicious rows into the checkpoint table. Once the poisoned data is in place, the second stage begins with CVE-2026-28277. The msgpack checkpoint decoder, while reconstructing Python objects from stored data, loads the malicious row. This triggers the import of arbitrary modules and the execution of functions such as `os.system`, granting the attacker the same permissions as the agent server. It is worth noting that users of the LangSmith platform utilizing PostgreSQL are shielded from this specific attack vector.
Langflow's CVE-2026-5027 operates through a simpler but equally devastating path traversal. The `POST /api/v2/files` endpoint writes filenames to the disk without sufficient validation. By including traversal sequences in the filename, an attacker can create files in sensitive system directories, such as `/etc/cron.d/`. The risk is amplified by Langflow's default configuration, where the auto-login feature is often enabled. This removes the authentication barrier entirely, allowing unauthenticated requests to gain shell access to the host system.
In LangChain-core, the vulnerability in the `load_prompt()` function (CVE-2026-34070) stems from a failure to validate absolute paths or traversal sequences when reading file paths from a configuration dictionary. This allows an attacker to read any file the process has access to. In a typical production environment, this leads directly to the theft of `.env` files containing highly sensitive credentials, such as `OPENAI_API_KEY` or `ANTHROPIC_API_KEY`.
This pattern reveals a fundamental tension in AI framework design: the drive for developer convenience often creates massive security holes. The auto-login in Langflow and the flexible prompt loading in LangChain-core were designed to reduce friction for developers, but in a production context, they act as open doors for attackers. Furthermore, these vulnerabilities expose a blind spot in traditional security stacks. A Web Application Firewall (WAF) cannot inspect the internal logic of a msgpack decoder operating three layers deep in the application logic. Similarly, Endpoint Detection and Response (EDR) tools often struggle to distinguish between a legitimate process call made by an AI agent and a malicious command executed via an RCE exploit. The agent's inherent nature—executing code and interacting with the system—provides the perfect camouflage for an attacker.
The realization for the community is that adopting an AI agent framework is not merely adding a library to a project; it is inheriting the entire security hygiene of that framework's supply chain. When a developer deploys these tools, they are not just deploying an LLM wrapper, but a complex piece of infrastructure that manages state, handles files, and interacts with databases. If the framework treats input validation as an afterthought, the entire agentic pipeline becomes a liability.
Security practitioners must now move beyond trusting default configurations. The principle of least privilege must be applied not just to the cloud IAM roles, but to the internal settings of the AI frameworks themselves. This means disabling auto-login, strictly validating all inputs before they reach the framework's internal APIs, and ensuring that dependency updates are handled with surgical precision. Because the patches for LangChain-core are distributed across different versions, a partial update could leave a system vulnerable to the most critical flaws while giving a false sense of security.
AI agent orchestration is no longer a playground for experimental scripts; it is becoming the backbone of enterprise automation. This shift requires treating these frameworks as critical infrastructure boundaries where every input is untrusted and every default is a potential vulnerability.
