CVE-2026-33017

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

• CWE-94
• CWE-95
• CWE-306

• https://github.com/advisories/GHSA-rvqx-wpfh-mfx7Third Party Advisory
• https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0Patch
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvxExploit, Mitigation, Vendor Advisory
• https://github.com/langflow-ai/langflow/releases/tag/1.8.2Release Notes
• https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017US Government Resource
• https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hoursPress/Media Coverage

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33010mcp-memory-service is an open-source memory backend for mult…8.8
• CVE-2026-33011Nest is a framework for building scalable Node.js server-sid…7.5
• CVE-2026-33012Micronaut Framework is a JVM-based full stack Java framework…7.5
• CVE-2026-33013Micronaut Framework is a JVM-based full stack Java framework…7.5
• CVE-2026-33014EVerest is an EV charging software stack. Prior to version 2…5.2
• CVE-2026-33015EVerest is an EV charging software stack. Prior to version 2…5.2
• CVE-2026-33018libsixel is a SIXEL encoder/decoder implementation derived f…7
• CVE-2026-33019libsixel is a SIXEL encoder/decoder implementation derived f…7.1
• CVE-2026-3302A weakness has been identified in SourceCodester Doctor Appo…6.1
• CVE-2026-33020libsixel is a SIXEL encoder/decoder implementation derived f…7.1
• CVE-2026-33021libsixel is a SIXEL encoder/decoder implementation derived f…7.3
• CVE-2026-33022Tekton Pipelines project provides k8s-style resources for de…6.5