Rubrik Highlights Critical Security Flaws in AI Development Platforms
By Rashmi Ramesh | July 1, 2026
In a significant disclosure, Rubrik Zero Labs has raised alarm over critical cybersecurity vulnerabilities found in the Langflow artificial intelligence development platform, highlighting a fundamental lack of security measures within AI systems. The flaws uncovered could allow malicious actors to gain unauthorized access to sensitive data, raising questions about the oversights prevalent in the rapidly evolving field of AI development.
Langflow is designed to enable developers to create AI applications effortlessly by allowing them to drag and drop pre-built blocks instead of having to write code from scratch. The convenience of this approach has garnered interest, but this newfound attention has also revealed serious security implications. Following the discovery, Rubrik conducted extensive research and reported its findings to Langflow’s maintainers in February, who managed to patch the vulnerabilities by May.
The most significant vulnerability identified allowed anyone with a link to a shared Langflow chatbot to gain complete control over its server. This included access to stored credentials, internal databases, and other connected systems. The issue arose from a public publishing feature of Langflow, which enabled users to create a chatbot accessible to anyone online. Every request sent through this public chat interface contained the underlying blueprint of the AI application, including the Python code for each component. Rubrik’s researchers discovered that by modifying this blueprint, they could execute arbitrary code on the server without requiring an account or password. This critical bug has been tracked as CVE-2026-48519.
Another serious exploit, termed "RAGPull," stemmed from the document upload functionality within Langflow. Users can upload documents, including compressed archives, to allow a chatbot to search through them using a method known as retrieval-augmented generation. However, the document parser was found to follow symlinks—shortcut files within uploaded archives—leading it to read files the shortcut pointed to rather than the actual contents of the archive. By exploiting this flaw, Rubrik’s team was able to upload an archive containing a symlink that directed to a file storing crucial server settings, including the administrator password. This exploit was tracked as CVE-2026-7524, enabling unauthorized access to sensitive information.
Additionally, researchers uncovered a third flaw allowing unauthenticated users to fill Langflow’s storage with files, thereby revealing the server’s file path. This vulnerability has been cataloged as CVE-2026-7528. A related bug permitted unauthorized users to feed local files into the AI model, which could potentially lead to further exploits, including remote code execution. This vulnerability is tracked under CVE-2026-48520.
Ori Lahav, a principal security researcher at Rubrik Zero Labs, expressed concerns over the systemic security deficiencies in AI platforms. Lahav noted that while each individual finding may appear to be an isolated issue, collectively they reveal a troubling pattern indicating that the industry is prioritizing rapid deployment over robust security measures. "It’s less that each vendor made the same mistake and more that the whole category is being built and shipped at a pace that may neglect the fundamentals," he stated.
What struck Lahav and his team was the prevalence of standard, underlying vulnerabilities. "Almost none of them were AI-specific," he explained. "They were classic web-application vulnerabilities." This underscores a disconnect between the marketing of AI tools and the conventional infrastructure that supports them, such as file systems, databases, and internal systems. "People picture AI as just the large language model, but they don’t see everything the LLM is wired into, like file systems, databases, and internal systems," Lahav added. "That’s where the real exposure lies."
For organizations unable to implement immediate patches, Lahav suggested alternative security measurements, such as deploying a reverse proxy that adds an authentication layer and inspects incoming requests before they reach the application. However, he cautioned that this approach could complicate deployment processes. "Defenders shouldn’t expect a clean, universal indicator of compromise to result from this research," he warned, emphasizing that different vulnerabilities will leave unique traces in the network and file systems.
Rubrik did not conduct scans for exposed and vulnerable Langflow deployments prior to their disclosure, but Lahav expects significant exposure among users. "All three of the platforms we investigated are widely used, and all have both cloud and self-hosted offerings, indicating many potential vulnerable targets exist," he said.
As the landscape of AI continues to evolve, Rubrik is set to disclose further vulnerabilities identified in other platforms, including n8n and Activepieces, in upcoming blog entries. This ongoing research aims to shed light on the critical need for improved security measures in the development of AI technologies.