Intel

CVE-2026-33017

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

criticalKEV: actively exploitedPoCEPSS 96%

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Source: OSVOSVEUVDCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With an EPSS score of 96.18 % (99.9th percentile), this vulnerability carries one of the highest empirical exploitation-probability ratings available and warrants immediate action regardless of CVSS base score. The attack requires zero authentication and zero preconditions: a single crafted POST request with attacker-controlled flow data containing arbitrary Python is passed directly to exec() with no sandboxing, yielding full remote code execution on the host. Langflow deployments typically sit adjacent to high-value assets — LLM API keys, internal data pipelines, and development infrastructure — making lateral movement post-exploitation highly likely. NIS2-scoped organisations running Langflow in any internet-facing or shared-network environment should treat this as a P0 incident and complete patching or isolation within 24 hours.

Runbook · Step 1

Immediate response (0-24 h)

  • Patch to Langflow ≥ 1.9.0 immediately: All instances running versions < 1.9.0 (including 0.0.31, 1.0.0a3–1.0.0a29) are vulnerable. Update via pip install langflow==1.9.0 or through your container/deployment pipeline. Verify the fix against the vendor's GitHub release tag 1.9.0.
  • Isolate internet-exposed Langflow instances: Any Langflow instance reachable from untrusted networks must be placed behind a firewall or authenticated reverse proxy immediately. Block inbound access to port 7860 (Langflow default) from all untrusted sources.
  • Block the vulnerable endpoint at the perimeter: On your WAF or reverse proxy, deny all POST requests to /api/v1/build_public_tmp/ until the patch is confirmed deployed. This endpoint is not required for normal operation unless you are explicitly serving public flows.
  • Inspect running processes and execution history: On the Langflow host, look for unexpected child processes spawned by the Langflow process (e.g. bash, python, curl, wget, nc). Review process trees and system logs for at least the past 72 hours.
  • Rotate all secrets accessible to the Langflow process: Treat all credentials reachable from the Langflow runtime as potentially compromised — environment variables, .env files, database credentials, and LLM API keys. Rotate immediately and audit access logs for those services.

Runbook · Step 2

Mitigation layers

  • WAF rule — method and path match: Create a rule blocking POST requests with URI path matching /api/v1/build_public_tmp/. Additionally, flag requests whose JSON body contains keys such as "code", "exec", or "nodes" targeting this path as high-severity alerts.
  • Network segmentation: Move Langflow instances into a dedicated VLAN or network segment accessible only from authorised internal hosts. Apply strict egress filtering — limit outbound connections to known LLM API endpoints and internal services only. This prevents reverse-shell callbacks even if code execution occurs.
  • Least-privilege process hardening: Run Langflow under a dedicated, non-privileged service account with no interactive shell. Apply a seccomp/AppArmor profile or Kubernetes PodSecurityContext (readOnlyRootFilesystem: true, allowPrivilegeEscalation: false) to restrict what the process can do post-exploitation.
  • Enforce authentication at the application layer: If Langflow is running with LANGFLOW_AUTO_LOGIN=true or without an authentication layer, disable this setting and enforce SSO/OAuth2 or HTTP Basic Auth at the reverse proxy before the patch is applied.
  • Suricata signature (conceptual): alert http any any -> $LANGFLOW_SERVERS 7860 (msg:"CVE-2026-33017 Langflow RCE attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/v1/build_public_tmp/"; http.request_body; content:"exec"; sid:9002633017; rev:1;)

Runbook · Step 3

Detection rules

  • Web access log analysis: Search for POST requests to /api/v1/build_public_tmp/ returning HTTP 200 with a request body > 500 bytes and no valid session cookie or Authorization header. SPL: index=webproxy method=POST uri="*/build_public_tmp/*" status=200 | stats count by src_ip, uri
  • Process ancestry (EDR/Sysmon EID 1): Alert on child processes of the Langflow Python process. Sigma shape: ParentImage|endswith: 'python*' AND Image|endswith one of ['/bin/bash', '/bin/sh', 'cmd.exe', 'powershell.exe', 'curl', 'wget'] — a direct indicator of exec()-based code execution.
  • Linux auditd — execve syscall under the Langflow service account: Auditd rule: -a always,exit -F arch=b64 -S execve -F uid=<langflow-uid> -k langflow_exec — any execve call from the Langflow process that does not correspond to the normal Python interpreter should be treated as suspicious.
  • Network telemetry (Zeek/Suricata): Flag outbound connections from the Langflow host to unknown external IPs on non-standard ports (anything other than 443/80 to known LLM endpoints) as potential reverse-shell or C2 callback activity. Zeek conn log filter: id.orig_h == <langflow_ip> AND id.resp_p != 443 AND id.resp_p != 80.
  • Credential/environment exfiltration: Monitor proxy and DNS logs for requests originating from the Langflow host that contain Base64-encoded strings or known exfiltration patterns (e.g. DNS queries with encoded subdomains, HTTP requests carrying env output).

Metrics

Severity
critical
Priority score
236.45
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.3
Source: nvd-v4
CVSS v3
—
CVSS v4
9.3
EPSS percentile
99.9 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
96.2 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-06-29 11:50 UTC
CWE
CWE-94, CWE-95, CWE-306

Weakness classes (CWE)

  • CWE-94Base

    Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

    cwe.mitre.org →

  • CWE-95Variant

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

    The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

    cwe.mitre.org →

  • CWE-306Base

    Missing Authentication for Critical Function

    The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

    cwe.mitre.org →

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • pypi

    langflow0.0.31

  • pypi

    langflow0.0.32

  • pypi

    langflow0.0.33

  • pypi

    langflow0.0.40

  • pypi

    langflow0.0.44

  • pypi

    langflow0.0.45

  • pypi

    langflow0.0.46

  • pypi

    langflow0.0.52

  • pypi

    langflow0.0.53

  • pypi

    langflow0.0.54

  • pypi

    langflow0.0.55

  • pypi

    langflow0.0.56

  • pypi

    langflow0.0.57

  • pypi

    langflow0.0.58

  • pypi

    langflow0.0.61

  • pypi

    langflow0.0.62

  • pypi

    langflow0.0.63

  • pypi

    langflow0.0.64

  • pypi

    langflow0.0.65

  • pypi

    langflow0.0.66

  • pypi

    langflow0.0.67

  • pypi

    langflow0.0.68

  • pypi

    langflow0.0.69

  • pypi

    langflow0.0.70

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2026-33017