CVE-2026-33017: critical vulnerability in langflow-ai langflow
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Published · Updated
98Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.3epss 25%
from disclosure to weapon1 days
Published on NVDMar 20
1st PoC+1d
metasploitMar 20
CISA KEV+5d
exploitation probability
25%top 2% of all CVEs
observed exploitation
yesCISA + VulnCheck
55 public exploit(s)
Action required by CISAfederal deadline: 2026-04-08
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
In short
Langflow allows anyone to run arbitrary code on the server through a public endpoint by uploading malicious workflow definitions without needing to log in. An attacker can execute any command they want on the machine running Langflow.
Technical detail
The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow versions before 1.9.0 accepts an optional data parameter containing attacker-controlled flow definitions with arbitrary Python code in node definitions, which are executed via exec() without sandboxing. Authentication is not required for this public endpoint, enabling unauthenticated remote code execution. The vulnerability was fixed in version 1.9.0 by removing acceptance of attacker-supplied flow data at this endpoint.
Summary generated and translated by AI from the official description.
The full analysis of this CVE is available in Portuguese →
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
langflow-ai · langflowpublic PoCs found — 55
exploitdbwww.exploit-db.com/exploits/52627unverifiedgithubgithub.com/EQSTLab/CVE-2026-33017★ 11githubgithub.com/MaxMnMl/langflow-CVE-2026-33017-poc★ 10githubgithub.com/z4yd3/PoC-CVE-2026-33017★ 5githubgithub.com/c0gnit00/CVE-2026-33017★ 2githubgithub.com/CerberusMrXi/Langflow-cve-2026-33017-exploit★ 2githubgithub.com/omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC★ 1githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-33017-Langflow-RCE★ 1githubgithub.com/e4zyy/Project-CVE-2026-33017★ 1githubgithub.com/yym8538/CVE-2026-33017★ 1githubgithub.com/Jorrit-VM/CVE-2026-33017★ 1githubgithub.com/lxxexxbxx/CVE-2026-33017★ 1githubgithub.com/oscar-mine/CVE-2026-33017-Exploit★ 0githubgithub.com/diamorphine666/CVE-2026-33017-Exploit★ 0githubgithub.com/Dynamo2k1/CVE-2026-33017★ 0githubgithub.com/TatoSec/CVE-2026-33017-Langflop★ 0githubgithub.com/yayip/CVE-2026-33017★ 0githubgithub.com/0xBlackash/CVE-2026-33017★ 0githubgithub.com/Oieua/CVE-2026-33017★ 0githubgithub.com/r3nsi15/CVE-2026-33017-langflow-rce★ 0githubgithub.com/l4st98/CVE-2026-33017-FireFlow★ 0githubgithub.com/rootdirective-sec/CVE-2026-33017-Lab★ 0githubgithub.com/masterwok/PoC-CVE-2026-33017★ 0githubgithub.com/Usman0220/CVE-2026-33017-Langflow-RCE★ 0githubgithub.com/SimoesCTT/Sovereign-Echo-33017★ 0githubgithub.com/ahseven/CVE-2026-33017-PoC-Reverse-Shell★ 0githubgithub.com/arensballiu/CVE-2026-33017-langflow-rce★ 0githubgithub.com/sonnelon/CVE-2026-33017-PoC★ 0githubgithub.com/maxprog-svg/CVE-2026-33017★ 0githubgithub.com/MaximilianoMeyer/CVE-2026-33017★ 0vulncheckvulncheck.com/xdb/fa8898fa1058unverifiedvulncheckvulncheck.com/xdb/128c643b4295unverifiedvulncheckvulncheck.com/xdb/d4cb580fda95unverifiedvulncheckvulncheck.com/xdb/962fc339235cunverifiedvulncheckvulncheck.com/xdb/9b5470493b33unverifiedvulncheckvulncheck.com/xdb/ef1b19f7f808unverifiedvulncheckvulncheck.com/xdb/8650d8dac236unverifiedvulncheckvulncheck.com/xdb/914c0c712894unverifiedvulncheckvulncheck.com/xdb/7a19f2392442unverifiedvulncheckvulncheck.com/xdb/4faffedb3d3aunverifiedvulncheckvulncheck.com/xdb/64142305d205unverifiedcve_referencemedium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896unverifiedvulncheckvulncheck.com/xdb/ba5e0ceeef5dunverifiedvulncheckvulncheck.com/xdb/7de9ed3991acunverifiedvulncheckvulncheck.com/xdb/68b622840e9cunverifiedvulncheckvulncheck.com/xdb/daded473321funverifiedvulncheckvulncheck.com/xdb/0c547656b877unverifiedvulncheckvulncheck.com/xdb/ae45df7a0d5bunverifiedvulncheckvulncheck.com/xdb/0173d6460f40unverifiedvulncheckvulncheck.com/xdb/51aa97c8213aunverifiedvulncheckvulncheck.com/xdb/0b50c2ba273dunverifiedvulncheckvulncheck.com/xdb/0256b62951fbunverifiedvulncheckvulncheck.com/xdb/bcc4af428232unverifiedvulncheckvulncheck.com/xdb/4ab37aea52adunverifiedvulncheckvulncheck.com/xdb/bd2107ab8557unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — langflow-ai langflow
In the same product, most dangerous first.
CVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-55255HIGHLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowEPSS 0.9%KEVCVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2025-68477HIGHLangflow vulnerable to Server-Side Request ForgeryEPSS 6.3%CVE-2025-68478HIGHLangflow Vulnerable to External Control of File Name or PathEPSS 5.8%CVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 4.8%
References
https://github.com/advisories/GHSA-rvqx-wpfh-mfx7https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0https://github.com/langflow-ai/langflow/releases/tag/1.8.2https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvxhttps://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours