Security researchers warn that 7,000 exposed Langflow servers are being actively exploited via CVE-2026-5027, a critical path traversal flaw requiring no credentials.