Sysdig Reports Langflow CVE-2026-33017 Exploited Within 20 Hours
Summary
Sysdig says its honeypots observed attackers exploit Langflow CVE-2026-33017 about 20 hours after disclosure, using Python code execution to probe systems and harvest credentials. The report details the activity and recommends patching, access restrictions and runtime\u
Key points
- CVE-2026-33017 is an unauthenticated RCE in Langflow's public flow build endpoint, which executes Python in flow node definitions without sandboxing.
- Sysdig reports its honeypots first observed exploitation about 20 hours after the advisory, before a public proof of concept was available.
- The observed activity included nuclei-based scanning followed by custom scripts for reconnaissance, stage-two payload delivery and credential harvesting.
- Sysdig says attackers searched environment variables, .env files and database files; its report describes data being sent to a C2 server.
- The source IPs may have been proxies or VPS nodes, and Sysdig says shared infrastructure could indicate one operator or a shared toolkit.
- Recommended defenses include updating Langflow, restricting or disabling public flow building, rotating exposed credentials, segmenting network access and using runtime behavior detection.
Article Details
- Attack Vectors
- Unauthenticated remote code execution through Langflow's public POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which executes attacker-supplied Python in flow node definitions without sandboxing.
- Automated nuclei-based scanning used exploit payloads to validate vulnerable instances and send results to unique interactsh callback subdomains.
- Custom Python exploit scripts performed reconnaissance, including directory and system checks, and attempted stage-2 retrieval with curl from attacker infrastructure.
- Post-exploitation activity included dumping environment variables, searching for .db and .env files, reading application secrets, and exfiltrating collected data over HTTP.
- Defensive Notes
- Update Langflow; if patching is unavailable, restrict access to or disable the public flow build endpoint.
- Audit exposed Langflow instances and rotate API keys, database passwords, cloud credentials, and other secrets.
- Restrict network access to Langflow using firewall rules or an authenticated reverse proxy; avoid direct internet exposure.
- Monitor runtime system-call and behavior-based detections for Python-driven shell commands, sensitive-file reads, curl-based payload retrieval, unusual outbound connections, and DNS or HTTP callbacks.
- Use network segmentation and monitor for connections to known callback services and unusual ports.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | d6tcpc6flblph01gdcb0ku9ixih393m54[.]oast[.]live | Ephemeral interactsh callback subdomain used to receive output from an exploit validation payload. |
| DOMAIN | d6tcpe7nsv6kk9rdrpggi37zmjfxw9imr[.]oast[.]me | Ephemeral interactsh callback subdomain observed in exploit activity. |
| DOMAIN | d6td5s9qte0bea7273e0wuou77jjx77uk[.]oast[.]pro | Ephemeral interactsh callback subdomain observed in automated scanning activity. |
| DOMAIN | d6tgbe1qte0a8rkffb3gqabqm8517exd3[.]oast[.]fun | Ephemeral interactsh callback subdomain observed in automated scanning activity. |
| IPV4 | 143[.]110[.]183[.]86 | C2 server reported to receive base64-encoded exfiltrated data. |
| IPV4 | 173[.]212[.]205[.]251 | Source IP associated with credential harvesting and the host serving the stage-2 dropper. |
| IPV4 | 188[.]166[.]209[.]86 | Source IP observed sending an automated exploit payload during nuclei scanning. |
| IPV4 | 205[.]237[.]106[.]117 | Source IP observed conducting automated nuclei scanning against vulnerable Langflow instances. |
| IPV4 | 209[.]97[.]165[.]247 | Source IP observed probing vulnerable Langflow instances with the automated exploit activity. |
| IPV4 | 77[.]110[.]106[.]154 | Source IP observed conducting nuclei scanning and exploitation of vulnerable Langflow instances. |
| IPV4 | 83[.]98[.]164[.]238 | Source IP used for custom exploit reconnaissance and a stage-2 payload delivery attempt. |
| URL | hxxp[:]//143[.]110[.]183[.]86:8080/ | C2 endpoint reported to receive exfiltrated data. |
| URL | hxxp[:]//173[.]212[.]205[.]251:8443/z | Attacker-hosted stage-2 dropper URL used in a curl retrieval attempt. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCollected command output and credentials were sent to attacker-controlled callback or C2 infrastructure.T1059.006 · PythonExploit payloads executed Python on the server, including os.popen() commands.T1071.001 · Web ProtocolsThe article reports HTTP-based callbacks and C2 communication, including outbound traffic to 143.110.183.86:8080.T1071.004 · DNSExploit validation used DNS callbacks to unique interactsh subdomains.T1082 · System Information DiscoveryAn attacker ran id to identify the execution context, which returned uid=1000(langflow).T1083 · File and Directory DiscoveryAttackers listed directories and searched /app for database and environment files.T1105 · Ingress Tool TransferAn attacker attempted to retrieve a stage-2 payload from the dropper using curl and execute it through a shell.T1190 · Exploit Public-Facing ApplicationAttackers exploited the unauthenticated public Langflow flow-build endpoint to gain remote code execution.T1552.001 · Credentials In FilesAttackers dumped environment variables and searched for or read .env files containing application secrets.
CVE
CVE-2025-3248langflow-ai · langflowThis is distinct from CVE-2025-3248, an earlier Langflow RCE added to CISA’s Known Exploited Vulnerabilities catalog in May 2025.CVE-2026-33017langflow-ai · langflowCVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow’s public flow build endpoint that attackers weaponized within ~20 hours of disclosure to execute arbitrary Python and exfiltrate credentials.
Vendors
Products
LangflowCVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow’s public flow build endpoint that attackers weaponized within ~20 hours of disclosure to execute arbitrary Python and exfiltrate credentials.Sysdig SecureThe exploitation patterns observed in this campaign produce clear signals at the system call level that tools like Falco and Sysdig Secure are designed to catch, without any prior knowledge of the specific CVE.
Tools
FalcoThe exploitation patterns observed in this campaign produce clear signals at the system call level that tools like Falco and Sysdig Secure are designed to catch, without any prior knowledge of the specific CVE.NucleiSysdig’s honeypots recorded rapid, multi-stage exploitation—nuclei-based scanning, custom Python exploit scripts, and staged dropper/C2 infrastructure—that harvested environment variables, .env files, and database