CVE-2026-33017

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 24.76%
EPSS Percentile: 97.86%
CISA KEV: YES — Known Exploited Vulnerability

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: security-advisories@github.com
Published: 20-Mar-2026 12:16
Last Modified: 17-Jun-2026 17:36
EPSS Date: 2026-10-11
CWE: CWE-94, CWE-95, CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:L /
                            SI:L /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2026-03-25
Remediation Due: 2026-04-08
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017

Affected Products / Versions

langflow / langflow
Version / affected range: * · before (exclusive) 1.8.2
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 09:39
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-33017 Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
CVE-2026-33017 is a critical code injection vulnerability in Langflow’s public flow build endpoint that allows unauthenticated remote code execution (RCE). Wazuh Shows How to Detect Exploitation of Langflow CVE-2026-33017
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer Langflow Flaw CVE-2026-33017 Used to Deliver Linux Cryptominer

CVE (73)

Malware (13)

People (2)

Threat Actors (3)

MITRE ATT&CK (29)

Vendors (24)

Products (25)

Tools (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.