AllCyberNews

CVE-2026-33017

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

CVSS 9.3 critical · langflow-ai langflow · published 2026-03-20

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

NVD · CVE.org

Coverage 3 sources

  1. 2026-03-25 CISA Cybersecurity Advisories critical CISA Adds One Known Exploited Vulnerability to Catalog

    CISA adds CVE-2026-33017 to its Known Exploited Vulnerabilities Catalog.

  2. 2026-03-26 BleepingComputer critical CISA: New Langflow flaw actively exploited to hijack AI workflows

    CISA warns of actively exploited Langflow flaw (CVSS: 9.8) affecting AI workflows.

  3. 2026-03-27 Help Net Security critical CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation

    CISA adds two vulnerabilities to its Known Exploited Vulnerabilities catalog.

Mentioned with

CVE-2026-33634

Also covered