Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306 and CWE-94.
Summary
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Langflow | langflow | before 1.9.0 | 1.9.0 | Patch available | CNA |
| — | langflow (PyPI) | before 1.9.0 | 1.9.0 | Patch available | GHSA-vwmf-pq79-vjvx |
- langflow VendorLangflow Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
- langflow (PyPI) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-vwmf-pq79-vjvx
Remediation
- Fix · CNA langflow (langflow-ai) Fixed in 1.9.0
- Fix · GHSA-vwmf-pq79-vjvx langflow (PyPI) Fixed in 1.9.0 Advisory →
Timeline
- 2026-03-25 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2026-33017
- 2026-10-03 Alias added: GHSA-vwmf-pq79-vjvx
- 2026-10-25 EPSS moved to the 99th percentile and above
References
Exploit 2
Advisory 2
Other 7
- https://github.com/langflow-ai/langflow/issues/12345
- https://github.com/langflow-ai/langflow/pull/12160
- https://github.com/langflow-ai/langflow
- https://github.com/langflow-ai/langflow/releases/tag/1.8.2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33017
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017
- https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours
More Langflow vulnerabilities
- TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
- TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
- TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
- TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
- TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
- TI-2026-22309 Langflow has Remote Code Execution in CSV Agent CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-33017 · CVE Program
- CVE-2026-33017 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-vwmf-pq79-vjvx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences