{"id":"CVE-2026-33017","kind":"vulnerability","aliases":["CVE-2026-33017"],"related":[],"title":"Langflow is a tool for building and deploying AI-powered agents and workflows","description":"Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.","summary":"Langflow's unauthenticated endpoint POST /api/v1/build_public_tmp/{flow_id}/flow accepts an attacker-supplied 'data' flow whose node code is run through exec() with no sandbox. Anyone who can reach a Langflow server with a public flow can run code on it. It is exploited in the wild and in CISA KEV (due 2026-04-08). Note: 1.8.2 was wrongly reported as patched; it is still vulnerable.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-03-25T00:00:00+00:00","products":[{"name":"Langflow Langflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"langflow","fixed":["1.9.0"],"affected":"<= 1.8.2","ecosystem":"pypi"},{"name":"langflow","fixed":["1.8.2"],"affected":"< 1.8.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-agents","ai-tooling","exploited","langflow","self-hosted"],"not_affected_if":["auth-required","no-public-flows","not-internet-exposed"],"how_to_check":"Run 'pip show langflow' or 'docker image inspect' to get the version; anything <= 1.8.2 (or 1.9.0.dev builds) is vulnerable. Exposed if the server is reachable and has at least one public flow. Check reverse-proxy logs for POST /api/v1/build_public_tmp/ requests from unknown IPs, and look for unexpected processes, NATS workers or new outbound connections.","fix":"Upgrade to langflow 1.9.0 or later (pip install -U 'langflow>=1.9.0', or the matching Docker image). Until then, take Langflow off the internet or block /api/v1/build_public_tmp at the proxy. If you were exposed, rotate API keys and secrets stored in Langflow (LLM provider keys, DB credentials).","status":"open","published_at":"2026-03-20T05:16:15+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:39:00+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-10-23T20:39:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or upgrade to a fixed Langflow release; the fixed version is unknown from the sources.\nIf no mitigation exists, CISA says to stop using the product.","reach":"internet","summary":"Langflow, an open-source visual builder for AI agent and LLM workflows, has a code injection flaw that lets anyone build public flows without logging in. CISA lists it as actively exploited, so an attacker can likely run code on the server hosting Langflow.","category":"ai-tooling","who_cares":["langflow","self-hosted","ai-agents"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Langflow server without logging in","analyst_note":"Find the affected and fixed Langflow versions and the vendor advisory from the CISA KEV entry for CVE-2026-33017, and confirm which flow-build endpoint is affected.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","no-public-flows"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000448,"input_tokens":2501,"output_tokens":396,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed Langflow versions and the vendor advisory from the CISA KEV entry for CVE-2026-33017, and confirm which flow-build endpoint is affected.","search":"'-04':90B '-08':91B '-2025':187C '-2026':16A,19A '-3248':188C '-33017':17A,20A '/api/v1/build_public_tmp':41B,124C '/api/v1/validate/code':191C '/flow':44B,127C '1.8.2':93B '1.9.0':121C,227C '2026':89B 'accept':45B,210C 'add':193C 'agent':12A,27B,114C 'ai':10A,26B,29B,112C 'ai-ag':25B 'ai-pow':9A,111C 'ai-tool':28B 'allow':129C 'anyon':62B 'arbitrari':152C,217C 'attack':48B,147C,212C 'attacker-control':146C 'attacker-suppli':47B,211C 'authent':135C,194C 'build':6A,108C,130C,196C 'cisa':86B 'code':54B,75B,154C,168C,180C,219C 'contain':151C,216C 'control':148C 'cve':15A,18A,186C 'data':50B,139C,150C,163C,215C 'databas':166C 'definit':157C 'deploy':8A,110C 'design':201C 'distinct':184C 'due':88B 'endpoint':39B,128C,144C,199C 'exec':58B,172C 'execut':181C,218C 'exploit':31B,80B 'fix':190C,224C 'flow':42B,51B,72B,125C,132C,149C,162C,207C,214C 'host':35B 'id':43B,126C 'incorrect':209C 'instead':158C 'issu':221C 'kev':87B 'langflow':1A,21A,22A,23A,24A,32B,36B,67B,103C 'node':53B,156C 'note':92B 'option':138C 'paramet':140C 'pass':170C 'patch':98B 'post':40B,123C 'power':11A,113C 'prior':119C 'public':71B,131C,197C,206C 'python':153C 'reach':65B 'remot':179C 'report':96B 'requir':134C 'result':176C 'run':56B,74B 'sandbox':61B,175C 'self':34B 'self-host':33B 'server':68B 'still':101B 'store':161C 'suppli':49B,142C,213C 'tmp':198C 'tool':4A,30B,106C 'unauthent':38B,178C,204C 'use':145C 'version':118C,226C 'vulner':102B 'whose':52B 'wild':83B 'without':133C 'workflow':14A,116C 'wrong':95B 'zero':174C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-20T05:16:15+00:00","kev":{"dateAdded":"2026-03-25","dueDate":"2026-04-08","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-33017","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33017","severity":null,"published_at":"2026-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33017:21","url":null,"severity":null,"published_at":"2026-10-23T20:39:38+00:00","modified_at":"2026-10-23T20:39:38+00:00","first_seen_at":"2026-10-23T20:39:38+00:00","fetched_at":"2026-10-23T20:39:38+00:00","note":"GHSA-vwmf-pq79-vjvx: unauthenticated RCE via POST /api/v1/build_public_tmp/{flow_id}/flow; attacker-supplied data param goes to exec(). Affected <= 1.8.2, fixed 1.9.0 (PR 12160 removes the data param). JFrog confirmed 1.8.2 is still vulnerable with a public PoC. KEV-listed. I did not read the PoC link itself."},{"source":"nvd","external_id":"CVE-2026-33017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33017","severity":null,"published_at":"2026-03-20T05:16:15+00:00","modified_at":"2026-06-17T10:36:47+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":853,"url":"https://github.com/advisories/GHSA-vwmf-pq79-vjvx","title":"GHSA-vwmf-pq79-vjvx: Unauthenticated RCE in Langflow via Public Flow Build Endpoint","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":854,"url":"https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/","title":"JFrog: Langflow CVE-2026-33017, 1.8.2 still exploitable","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":855,"url":"https://github.com/langflow-ai/langflow/pull/12160","title":"Langflow PR 12160: fix removing data parameter","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}