Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint (CVE-2026-33017)

What is affected, what to do

Langflow has a vulnerability allowing unauthenticated remote code execution (RCE). Attackers can create public flows without authentication and execute arbitrary Python code by manipulating API endpoints. This vulnerability is actively exploited. Affected versions include 0.0.31 to 0.0.52, prior to version 1.9.0. An immediate patch to version 1.9.0 is urgently required to mitigate the risk.

The vulnerability is being actively exploited; treat it as a priority. Update Langflow to version 1.9.0. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Langflow lt *..1.9.0

Fixed in

• Langflow 1.9.0

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade every Langflow instance to version 1.9.0 (pip install --upgrade langflow==1.9.0 or pin the container image to 1.9.0). This is the only complete fix and closes the unauthenticated RCE path through POST /api/v1/build_public_tmp/{flow_id}/flow.
   • Until patched: block /api/v1/build_public_tmp/* at the fronting reverse proxy (NGINX, Traefik, Envoy, AWS ALB/WAF) with a hard 403 for all methods. Surgical, sacrifices public-flow functionality, but kills the exec() path.
   • Reduce exposure immediately: pull Langflow off the internet, put it behind VPN or a zero-trust proxy, or restrict source IPs via security group / firewall. Pay special attention to deployments on 7860/tcp, 3000/tcp, or behind public load balancers.
   • Compromise assessment: treat every host that ran a vulnerable, internet-exposed Langflow as potentially compromised. Hunt for unexpected child processes of the Langflow / Python / Uvicorn worker, new cron jobs, injected SSH keys, container escapes, and outbound C2 beacons.
   • Rotate credentials: every secret present in the Langflow environment — OpenAI / Anthropic / Azure API keys, vector-DB credentials, database connection strings, cloud IAM role of the pod/host. RCE as the service user means these must be considered leaked.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: place Langflow workloads in an isolated VLAN or namespace, egress-filtered to whitelisted LLM endpoints only. No direct reachability to internal databases, cloud metadata services (169.254.169.254), or admin networks.
   • WAF / reverse-proxy rule: block the request pattern "POST /api/v1/build_public_tmp/"; secondarily drop requests to this path containing JSON body keys "code", "nodes", or "data". ModSecurity example: SecRule REQUEST_URI "@beginsWith /api/v1/build_public_tmp/" "id:900333,phase:1,deny,status:403".
   • Container hardening: run Langflow with read-only rootfs, non-root UID, default seccomp profile, drop ALL capabilities, no_new_privileges. Enforce Kubernetes PodSecurity "restricted". Limits persistence after a successful injection.
   • Egress control: restrict outbound traffic from the Langflow pod to a defined allow-list (api.openai.com, etc.), default-deny everything else. Blocks payload staging and C2.
   • IAM least-privilege: trim the cloud role attached to the pod/host to minimal permissions; no wildcard S3, Secrets Manager, or iam:PassRole. Where possible, enforce IMDSv2 with hop-limit 1.
   • Fronting authN: place an auth layer (oauth2-proxy, Authelia, Cloudflare Access) in front of Langflow that forces SSO on every request, including the "public" endpoints.
3. 03

   Runbook step 3

   Detection rules

   • Web / access logs: any POST to /api/v1/build_public_tmp/*/flow with a body larger than a few kilobytes is suspicious. Sigma shape: selection.cs-uri-stem contains "/api/v1/build_public_tmp/" AND cs-method = "POST" AND cs-bytes greater_than 2048.
   • Process ancestry (Sysmon EID 1 / EDR): Langflow / Python / Uvicorn worker spawning child processes like sh, bash, curl, wget, nc, python -c, base64 -d. KQL shape: DeviceProcessEvents | where InitiatingProcessFileName in~ ("python","python3","uvicorn") and FileName in~ ("sh","bash","curl","wget","nc","ncat").
   • Linux auditd: execve calls with ppid of a Langflow worker and comm in shell / download tooling; plus connect() syscalls to 169.254.169.254 (cloud-metadata exfiltration).
   • Network telemetry (Zeek / Suricata): new outbound connections from the Langflow host to non-allow-listed IPs, especially 4444/tcp, 1337/tcp, or TLS to freshly registered domains. Suricata rule: alert tcp $LANGFLOW_NET any -> !$LLM_ALLOWLIST any (msg:"Langflow unexpected egress"; sid:XXXXX;).
   • Filesystem monitoring: new files with the execute bit in /tmp, /var/tmp, /dev/shm inside the Langflow container; new entries in ~/.ssh/authorized_keys or in crontab paths.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Source: NVD (NIST), OSV (Open Source Vulnerabilities), CISA KEV Catalog, CVE.org (MITRE), pwn.watch, cvelistv5, ENISA EUVD

Vendors and products

• IBM IBM Langflow OSS
• Langflow-ai Langflow

Weakness classes (CWE)

• CWE-94Improper Control of Generation of Code ('Code Injection')

  Base

  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

  Entry at MITRE CWE-94

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

  Variant

  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

  Entry at MITRE CWE-95

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• github.comlangflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvxweb, x_refsource_CONFIRM, Exploit, Mitigation, Vendor advisory, pwn-watch
• NVD (NIST)NVD: CVE-2026-33017advisory, pwn-watch
• github.comlangflow-ai/langflow/issues/12345web
• github.comlangflow-ai/langflow/pull/12160web
• github.comlangflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd4732…web, x_refsource_MISC, Patch
• GitHub Security Advisoriesadvisories/GHSA-rvqx-wpfh-mfx7advisory, x_refsource_MISC, Third-party advisory
• github.comlangflow-ai/langflowpackage
• github.comlangflow-ai/langflow/releases/tag/1.8.2web, Patch, Release notes
• medium.com@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-…web, Exploit, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33017web
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017web, government-resource, US government resource
• sysdig.comblog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipel…web, Third-party advisory, Press coverage
• pypi.orgproject/langflowpackage
• GitHub Security Advisoriesadvisories/GHSA-vwmf-pq79-vjvxadvisory
• pwn.watchpwn.watch: Langflow Langflow: Langflow Code Injection Vulnerabilitypwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch