CVE-2026-33017: fallo crítico en langflow-ai langflow
Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.3epss 96%
de la publicación al arma1 día
Publicada en NVD20 mar
1ª PoC+1d
metasploit20 mar
CISA KEV+5d
Acción exigida por CISAplazo federal: 2026-04-08
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
En resumen
Langflow permite que cualquier persona ejecute código arbitrario en el servidor a través de un endpoint público enviando definiciones de flujo maliciosas sin necesidad de iniciar sesión. Un atacante puede ejecutar cualquier comando en la máquina que ejecuta Langflow.
Detalle técnico
El endpoint POST /api/v1/build_public_tmp/{flow_id}/flow en Langflow anterior a la versión 1.9.0 acepta un parámetro data opcional conteniendo definiciones de flujo controladas por el atacante, con código Python arbitrario en definiciones de nodos, que se ejecutan vía exec() sin aislamiento. Al no requerir autenticación en este endpoint público, permite ejecución remota de código no autenticada. La vulnerabilidad fue corregida en versión 1.9.0 eliminando la aceptación de datos de flujo suministrados por el atacante en este endpoint.
Resumen generado y traducido por IA a partir de la descripción oficial.
El análisis completo de esta CVE está disponible en portugués →
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Productos afectados
langflow-ai · langflowPoCs públicas encontradas — 59
exploitdbwww.exploit-db.com/exploits/52627no verificadogithubgithub.com/EQSTLab/CVE-2026-33017★ 12githubgithub.com/MaxMnMl/langflow-CVE-2026-33017-poc★ 10githubgithub.com/z4yd3/PoC-CVE-2026-33017★ 5githubgithub.com/c0gnit00/CVE-2026-33017★ 2githubgithub.com/CerberusMrXi/Langflow-cve-2026-33017-exploit★ 2githubgithub.com/lxxexxbxx/CVE-2026-33017★ 1githubgithub.com/e4zyy/Project-CVE-2026-33017★ 1githubgithub.com/omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC★ 1githubgithub.com/MaximilianoMeyer/CVE-2026-33017★ 1githubgithub.com/Jorrit-VM/CVE-2026-33017★ 1githubgithub.com/yym8538/CVE-2026-33017★ 1githubgithub.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-33017-Langflow-RCE★ 0githubgithub.com/sonnelon/CVE-2026-33017-PoC★ 0githubgithub.com/diamorphine666/CVE-2026-33017-Exploit★ 0githubgithub.com/Dynamo2k1/CVE-2026-33017★ 0githubgithub.com/1337or420/CVE-2026-33017-Langflow-RCE★ 0githubgithub.com/TatoSec/CVE-2026-33017-Langflop★ 0githubgithub.com/oscar-mine/CVE-2026-33017-Exploit★ 0githubgithub.com/maxprog-svg/CVE-2026-33017★ 0githubgithub.com/l4st98/CVE-2026-33017-FireFlow★ 0githubgithub.com/SimoesCTT/Sovereign-Echo-33017★ 0githubgithub.com/rootdirective-sec/CVE-2026-33017-Lab★ 0githubgithub.com/masterwok/PoC-CVE-2026-33017★ 0githubgithub.com/0xBlackash/CVE-2026-33017★ 0githubgithub.com/arensballiu/CVE-2026-33017-langflow-rce★ 0githubgithub.com/yayip/CVE-2026-33017★ 0githubgithub.com/Usman0220/CVE-2026-33017-Langflow-RCE★ 0githubgithub.com/ahseven/CVE-2026-33017-PoC-Reverse-Shell★ 0githubgithub.com/r3nsi15/CVE-2026-33017-langflow-rce★ 0githubgithub.com/Oieua/CVE-2026-33017★ 0vulncheckvulncheck.com/xdb/64142305d205no verificadovulncheckvulncheck.com/xdb/ba5e0ceeef5dno verificadovulncheckvulncheck.com/xdb/8650d8dac236no verificadovulncheckvulncheck.com/xdb/7a19f2392442no verificadovulncheckvulncheck.com/xdb/ef1b19f7f808no verificadovulncheckvulncheck.com/xdb/0c547656b877no verificadovulncheckvulncheck.com/xdb/ae45df7a0d5bno verificadovulncheckvulncheck.com/xdb/0173d6460f40no verificadovulncheckvulncheck.com/xdb/51aa97c8213ano verificadovulncheckvulncheck.com/xdb/0b50c2ba273dno verificadovulncheckvulncheck.com/xdb/0256b62951fbno verificadovulncheckvulncheck.com/xdb/bcc4af428232no verificadovulncheckvulncheck.com/xdb/4ab37aea52adno verificadovulncheckvulncheck.com/xdb/bd2107ab8557no verificadovulncheckvulncheck.com/xdb/fa8898fa1058no verificadovulncheckvulncheck.com/xdb/128c643b4295no verificadovulncheckvulncheck.com/xdb/d4cb580fda95no verificadovulncheckvulncheck.com/xdb/962fc339235cno verificadovulncheckvulncheck.com/xdb/4faffedb3d3ano verificadovulncheckvulncheck.com/xdb/4c6e503f4162no verificadovulncheckvulncheck.com/xdb/daded473321fno verificadovulncheckvulncheck.com/xdb/9b5470493b33no verificadocve_referencemedium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896no verificadovulncheckvulncheck.com/xdb/7de9ed3991acno verificadovulncheckvulncheck.com/xdb/68b622840e9cno verificadovulncheckvulncheck.com/xdb/91c3245e54e7no verificadovulncheckvulncheck.com/xdb/914c0c712894no verificadovulncheckvulncheck.com/xdb/0e4b2f1318d2no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — langflow-ai langflow
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-55255HIGHLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowEPSS 0.9%KEVCVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 40.0%CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 35.2%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2026-33497HIGHLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file readingEPSS 19.6%
Referencias
https://github.com/advisories/GHSA-rvqx-wpfh-mfx7https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0https://github.com/langflow-ai/langflow/releases/tag/1.8.2https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvxhttps://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours