Path traversal vulnerability in Langflow AI platform actively exploited

Impact verdict

Medium impact. Loss pathway is cyber. Unauthenticated exploitation of a widely deployed AI development platform, combined with default unauthenticated auto-login and a history of prior Langflow CVEs being exploited (including a CISA-noted link to the Iranian state-sponsored group MuddyWater), raises the ceiling of potential accumulation risk. Counterweights: no confirmed insured losses, breach notifications, or claims activity, and exploitation evidence to date is limited to test file drops detected in honeypots. Materiality depends on patch adoption rates among the exposed footprint and whether exploitation progresses beyond initial access. Relevant to cyber underwriters monitoring accumulation risk across AI/tech insureds and to incident-response capacity planning.