Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-33017 9.8
Langflow · Langflow · Added 2026-03-25 · Published 2026-03-20
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityLangflow Code Injection Vulnerability
VendorLangflow
ProductLangflow
Date added2026-03-25
Due date2026-04-08
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-306 CWE-94 CWE-95
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

NVD: Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-06-12 20:05 UTC
Wall time0.5s
Searches3
Component defaultyes
Sources https://nvd.nist.gov/vuln/detail/CVE-2026-33017
https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
https://github.com/MaxMnMl/langflow-CVE-2026-33017-poc
https://github.com/z4yd3/PoC-CVE-2026-33017
https://github.com/omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC
https://github.com/oscar-mine/CVE-2026-33017-Exploit
https://github.com/EQSTLab/CVE-2026-33017
https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours
https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/
https://github.com/langflow-ai/langflow/pull/12160
https://osv.dev/vulnerability/CVE-2026-33017

QC notes

warn component_extraction: Component 'Langflow build_public_tmp endpoint - specifically the POST /api/v1/build_public_tmp/{flow_id}/flow API handler (chat.py) that accepts attacker-controlled flow data via the optional 'data' parameter and passes Python code embedded in node definitions to exec() via create_class() -> prepare_global_scope() with zero sandboxing' matches or contains product name 'Langflow' — no specific component identified

Hunting hypothesis agent

Monitor for unauthenticated POST requests to Langflow /api/v1/build_public_tmp/ endpoints containing attacker-controlled Python code in flow data node definitions passed to exec().

Research details

ComponentLangflow build_public_tmp endpoint - specifically the POST /api/v1/build_public_tmp/{flow_id}/flow API handler (chat.py) that accepts attacker-controlled flow data via the optional 'data' parameter and passes Python code embedded in node definitions to exec() via create_class() -> prepare_global_scope() with zero sandboxing
PreconditionsNetwork reachability to the Langflow web API (typically TCP port 7860); Target must run Langflow version < 1.9.0 (including 1.7.3, 1.8.1, 1.8.2 which is falsely claimed as fixed); No authentication required; the endpoint is intentionally unauthenticated for public flows; At least one public flow must exist on the target (can be created via AUTO_LOGIN endpoint if enabled); When AUTO_LOGIN=true (default), attacker can create a public flow via GET /api/v1/auto_login -> POST /api/v1/flows/ then exploit via build_public_tmp; No user interaction required; Only a client_id cookie with any arbitrary string value is needed agent
DeliveryRemote network delivery: An unauthenticated attacker sends a single HTTP POST request to /api/v1/build_public_tmp/{flow_id}/flow on the target Langflow instance. The request body contains a JSON payload with a 'data' object representing a malicious flow graph. The graph includes at least one CustomComponent node whose 'code' template field contains arbitrary Python code (e.g., os.popen('id').read() for OOB exfiltration, or a full reverse shell). If AUTO_LOGIN=true (default), the attacker can first call GET /api/v1/auto_login to obtain a superuser token, then POST /api/v1/flows/ to create a public flow, obtaining the required flow_id. If a public flow already exists, the attacker can skip these steps and use the existing flow_id. The request requires no authentication headers - only a client_id cookie with any arbitrary string value. The server processes the malicious flow data through its graph build pipeline, ultimately executing the attacker's Python code via exec() with full server process privileges. No user interaction is required.
Public PoCunknown
PoC URLs https://github.com/MaxMnMl/langflow-CVE-2026-33017-poc
https://github.com/z4yd3/PoC-CVE-2026-33017
https://github.com/omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC
https://github.com/oscar-mine/CVE-2026-33017-Exploit
https://github.com/EQSTLab/CVE-2026-33017 Third-party repos; verify before use.
Advisoryhttps://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0). Multiple public PoCs exist including comprehensive Python exploit scripts. The vulnerability is trivial to exploit - a single POST request with a JSON body containing a CustomComponent node with malicious Python code in the 'code' field. No authentication, no user interaction required. Exploitation began within 20 hours of advisory publication (Sysdig observed first attacks Mar 18, 2026). JFrog confirmed that version 1.8.2, falsely claimed as fixed, remains fully exploitable. The true fix is in version 1.9.0 which removes the 'data' parameter entirely.
SummaryCVE-2026-33017 is an unauthenticated remote code execution vulnerability in Langflow, an open-source platform for building AI-powered agents and workflows. The flaw exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to allow unauthenticated users to build public flows. The endpoint accepts an optional 'data' parameter containing attacker-controlled flow definitions. When supplied, Langflow processes the payload through build_graph_from_data() -> Graph.from_payload() -> instantiate_component() -> create_class() -> prepare_global_scope() which ultimately calls exec() on arbitrary Python code embedded in node definitions without any sandboxing. The vulnerability affects all versions prior to 1.9.0, including version 1.8.2 which was incorrectly claimed as fixed (JFrog confirmed 1.8.2 remains exploitable). Active exploitation began within 20 hours of the advisory publication on March 17, 2026, before any public PoC existed, with attackers using private nuclei templates and custom Python scripts. Observed kill chain includes: mass scanning with OOB exfiltration payloads (id output sent via DNS/HTTP to interact.sh/oast), credential harvesting from environment variables and .env files, and C2 staging via dropped scripts. Sysdig observed four distinct attacker IPs within minutes of each other, all using identical payloads. Key indicators: POST requests to /api/v1/build_public_tmp/ with large JSON bodies containing CustomComponent nodes and 'code' fields with Python, outbound DNS lookups to oast.live/oastify.com, and processes spawning shell/curl commands from the Langflow server.

Tia coverage

First reported2026-05-14
First exploit report2026-05-14
Exploit report → KEV50 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

langflow-cve-2026-33017-actively-exploited-keyhunter-botnet-usesunit-42-hacker-uses-deepseek-open-source-ai-agent-for-fully-auto

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub