CVE-2026-33017

Published Mar 20, 2026

Last updated 3 months ago

Exploit known CVSS critical 9.3

Ubuntu

API

Tunneling protocol

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-33017 is an unauthenticated remote code execution (RCE) vulnerability found in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. This flaw specifically impacts the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint in Langflow versions prior to 1.9.0. While this endpoint is intended to allow unauthenticated users to build public flows, it improperly accepts an optional `data` parameter. When an attacker supplies this `data` parameter, it can contain arbitrary Python code embedded within node definitions. This malicious code is then executed by Python's `exec()` function without any sandboxing, input validation, or code sanitization, leading to the remote execution of arbitrary code on the vulnerable system. This vulnerability is distinct from a previous similar issue, CVE-2025-3248, which was addressed by adding authentication to a different endpoint but did not fully resolve the underlying unsafe execution design.

Description: Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.
Source: security-advisories@github.com
NVD status: Analyzed
Products: langflow

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Langflow Code Injection Vulnerability
Exploit added on: Mar 25, 2026
Exploit action due: Apr 8, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B38E7511-B77D-4E5F-B33A-458EE5770358",
            "versionEndExcluding": "1.8.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.