---
id: "CVE-2026-33017"
kind: "vulnerability"
aliases: ["CVE-2026-33017"]
title: "Langflow is a tool for building and deploying AI-powered agents and workflows"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "ai-tooling"
products: [{"name": "Langflow Langflow", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "langflow", "fixed": ["1.9.0"], "affected": "<= 1.8.2", "ecosystem": "pypi"}, {"name": "langflow", "fixed": ["1.8.2"], "affected": "< 1.8.2", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ai-agents", "ai-tooling", "exploited", "langflow", "self-hosted"]
not_affected_if: ["auth-required", "no-public-flows", "not-internet-exposed"]
published_at: "2026-03-20T05:16:15+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33017", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:39:38+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33017", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Langflow is a tool for building and deploying AI-powered agents and workflows

Langflow's unauthenticated endpoint POST /api/v1/build_public_tmp/{flow_id}/flow accepts an attacker-supplied 'data' flow whose node code is run through exec() with no sandbox. Anyone who can reach a Langflow server with a public flow can run code on it. It is exploited in the wild and in CISA KEV (due 2026-04-08). Note: 1.8.2 was wrongly reported as patched; it is still vulnerable.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Langflow Langflow affected ? fixed ?
- pypi:langflow affected <= 1.8.2 fixed 1.9.0
- vendor:langflow affected < 1.8.2 fixed 1.8.2

## How to check

Run 'pip show langflow' or 'docker image inspect' to get the version; anything <= 1.8.2 (or 1.9.0.dev builds) is vulnerable. Exposed if the server is reachable and has at least one public flow. Check reverse-proxy logs for POST /api/v1/build_public_tmp/ requests from unknown IPs, and look for unexpected processes, NATS workers or new outbound connections.

## Fix

Upgrade to langflow 1.9.0 or later (pip install -U 'langflow>=1.9.0', or the matching Docker image). Until then, take Langflow off the internet or block /api/v1/build_public_tmp at the proxy. If you were exposed, rotate API keys and secrets stored in Langflow (LLM provider keys, DB credentials).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-33017
- 2026-10-23T20:39:38+00:00 analyst — GHSA-vwmf-pq79-vjvx: unauthenticated RCE via POST /api/v1/build_public_tmp/{flow_id}/flow; attacker-supplied data param goes to exec(). Affected <= 1.8.2, fixed 1.9.0 (PR 12160 removes the data param). JFrog confirmed 1.8.2 is still vulnerable with a public PoC. KEV-listed. I did not read the PoC link itself.
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-33017

## Documents

- [advisory] GHSA-vwmf-pq79-vjvx: Unauthenticated RCE in Langflow via Public Flow Build Endpoint https://github.com/advisories/GHSA-vwmf-pq79-vjvx
- [discussion] JFrog: Langflow CVE-2026-33017, 1.8.2 still exploitable https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/
- [fix] Langflow PR 12160: fix removing data parameter https://github.com/langflow-ai/langflow/pull/12160

## From the sources

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_