Langflow is a tool for building and deploying AI-powered agents and workflows.
CVE-2026-33017 Exploited
Summary The POST /api/v1/buildpublictmp/{flowid}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The buildpublictmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. Affected Code Vulnerable Endpoint (No Authentication) File: src/backend/base/langflow/api/v1/chat.py, lines 580-657 python @router.post("/buildpublictmp/{flowid}/flow") async def buildpublictmp( , flowid: uuid.UUID, data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED request: Request, ... NO Depends(getcurrentactiveuser) -- MISSING AUTH ... ): """Build a public flow without requiring authentication.""" clientid = request.cookies.get("clientid") owneruser,…
Being exploited in the wild
Catalogued 25 March 2026 · US federal remediation deadline 8 April 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploit code is also public: Metasploit · Exploit-DB · Public PoC · Nuclei template
- Metasploitexploit/multi/http/langflow_unauth_rce_cve_2026_33017
- Exploit-DBLangflow 1.9.0 - RCE
- NucleiLangflow < 1.9.0 - Remote Code Execution
- Public PoCEQSTLab/CVE-2026-3301712 stars
- Public PoCMaxMnMl/langflow-CVE-2026-33017-poc10 stars
- Public PoCz4yd3/PoC-CVE-2026-330175 stars
- Public PoCc0gnit00/CVE-2026-330172 stars
- Public PoCCerberusMrXi/Langflow-cve-2026-33017-exploit2 stars
- Public PoComer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC1 stars
- Public PoCJorrit-VM/CVE-2026-330171 stars
- Public PoClxxexxbxx/CVE-2026-330171 stars
Part of the AI stack
This affects Langflow, in Agent frameworks.
Assessment
- CVSS
- 9.3 (v4.0)
- Severity
- Critical
- EPSS
- 96.18% chance of exploitation in the next 30 days
- Known exploited
- Yes — listed in the CISA KEV catalog
- Exploit availability
- CISA KEV, Metasploit, Exploit-DB, Public PoC, Nuclei template
- Published
- 17 March 2026
- Last updated
- 17 June 2026
- Affected
- Langflow · langflow-ai · Langflow · langflow · langflow
- Weakness
- CWE-306, CWE-94, CWE-95
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
At the source
References
- https://github.com/advisories/GHSA-rvqx-wpfh-mfx7
- https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
- https://github.com/langflow-ai/langflow/releases/tag/1.8.2
- https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017
- https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://nvd.nist.gov/vuln/detail/CVE-2026-33017
- https://github.com/langflow-ai/langflow/pull/12160
- https://github.com/langflow-ai/langflow/issues/12345
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33017
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-33017