CVE-2026-33017: Langflow Code Injection Vulnerability
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Overview
Langflow, an open-source platform for building AI agent workflows, contains an unauthenticated remote code execution flaw in versions prior to 1.9.0. The public flow build endpoint accepts attacker-supplied Python code embedded in flow node definitions and passes it directly to an unsandboxed exec() call, requiring no credentials. An attacker who can reach the API and identify a public flow UUID can execute arbitrary code on the server, with observed exploitation including credential and key exfiltration from connected systems.
Vulnerability details
The vulnerable endpoint, POST /api/v1/build_public_tmp/{flow_id}/flow, is intentionally unauthenticated to support Langflow's public flow sharing feature. When an optional data parameter is included in the request body, the endpoint substitutes the attacker-supplied flow definition for the stored one rather than rejecting it. The injected node definitions contain arbitrary Python code that travels through the graph-building pipeline and reaches exec() in validate.py without any sandboxing, import restrictions, or code validation. This is a classic eval injection flaw (CWE-95) compounded by a missing authentication check on a code-executing function (CWE-306).
An attacker sends a single crafted HTTP POST request to the build_public_tmp endpoint with a JSON body whose data.nodes array contains a node embedding arbitrary Python. Only a valid public flow UUID and an arbitrary client_id cookie value are required. When AUTO_LOGIN is enabled (the default configuration), an unauthenticated attacker can obtain a superuser token via /api/v1/auto_login, create a public flow, and then exploit the endpoint without any prior access. Sysdig observed working exploits in the wild within 20 hours of advisory publication, with attackers exfiltrating credentials and keys from connected databases.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor HTTP POST requests to paths matching /api/v1/build_public_tmp/*/flow that include a data parameter in the request body. Legitimate public flow execution does not supply a data override; any such request is anomalous and warrants immediate investigation.
- Audit web server or application logs for requests to /api/v1/auto_login followed shortly by POST /api/v1/flows/ and then POST /api/v1/build_public_tmp/*/flow from the same source IP, indicating the attacker-controlled flow creation chain used when AUTO_LOGIN=true.
Remediation
Additional hardening
- Upgrade Langflow to version 1.9.0 or later, which contains the fix for this vulnerability. Instances running any version prior to 1.9.0 are affected and should be treated as potentially compromised if they were network-reachable.
- Disable AUTO_LOGIN (set AUTO_LOGIN=false) on any instance not requiring it. The default enabled state allows an unauthenticated attacker to create a public flow and satisfy all exploit preconditions without any existing access.
- Restrict network access to the Langflow API to trusted clients only. Instances exposed directly to the internet are at highest risk; place the service behind a reverse proxy or firewall that limits access to known IP ranges.
- Audit all public flows on existing instances and remove any that are not operationally required, reducing the attack surface by eliminating valid flow UUIDs an attacker could target.
Key dates
References
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx
- https://nvd.nist.gov/vuln/detail/CVE-2026-33017
- https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896
- https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours
- https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0
- https://github.com/advisories/GHSA-rvqx-wpfh-mfx7
- https://github.com/langflow-ai/langflow/releases/tag/1.8.2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017
Frequently asked questions
Does CVE-2026-33017 affect my FedRAMP authorization?
If Langflow runs inside your authorization boundary, CVE-2026-33017 affects your Federal Risk and Authorization Management Program (FedRAMP) authorization directly. CISA's Known Exploited Vulnerabilities (KEV) catalog includes this vulnerability, and its remediation deadline of April 8, 2026 has already passed. An unpatched KEV inside your boundary is an assessor finding, and an overdue one is visible to both your assessor and your sponsoring agency. At this point, you either remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-33017?
Knox does not patch your Langflow installation. Under the FedRAMP shared-responsibility model, that remediation is yours to own. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, along with Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. The work of closing CVE-2026-33017 belongs to your team; managing your compliance posture while you do it does not have to fall entirely on you.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-33017 surfaces, exposure appears during ongoing monitoring rather than waiting to be flagged at an assessor review. That difference in timing gives your team room to act before a finding becomes a formal record.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-33017's remediation deadline of April 8, 2026 has passed. What happens now?
If CVE-2026-33017 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the vulnerability out now and documenting why the deadline was missed is what keeps your authorization standing and your agency relationship in good order.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
