CVE-2026-33017

Confirmed PUBLISHED

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

langflow-ai · langflow

1 day faster than CISA KEV

Exploited in the wild Active exploitation observed PoC available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

Unique Attacker IPs

CISA KEV

In CISA KEV

CVSS / EPSS

9.3 Critical EPSS 98.2%

At a Glance

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

nuclei_scanner cisa python

CVE Published: Mar 20, 2026
Exploitation Reported: Jun 01, 2026
CVSS: 9.3 Critical
EPSS: 98.2%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
langflow-ai	langflow	< 1.9.0	Affected

CVE References

https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx github.com · CVE Record https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf...
https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0 github.com · CVE Record https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752...
https://github.com/advisories/GHSA-rvqx-wpfh-mfx7 github.com · CVE Record https://github.com/advisories/GHSA-rvqx-wpfh-mfx7

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2026-06-01 12:26 UTC
CISA	2026-06-02 14:02 UTC
KEVIntel	2026-07-14 17:21 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Attacker IP IoCs observed in KEVIntel sensors are available to Pro and Enterprise accounts on the Detection tab and through the Pro API.

Learn about Pro API access

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 1
Distinct User-Agents: 0

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33017.yaml	Jun 01, 2026

CVSS Scores

CVSS v4.0 9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-01 12:26:07 UTC · CVE

Active exploitation observed

Recorded 2026-07-14 15:39:11 UTC · KEVIntel sensor

Proof of concept available

Recorded 2026-03-31 02:10:40 UTC · GitHub

Weaknesses (CWE)

CWE-306

Missing Authentication for Critical Function
CWE-94

Improper Control of Generation of Code ('Code Injection')
CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33017.yaml	Jun 01, 2026

Recent Mentions

One POST to RCE: Unauthenticated Code Execution in Langflow (CVE-2026-33017)

DarkWebInformer · Jun 30, 2026

CVE-2026-33017 is a critical unauthenticated remote code execution flaw in Langflow, the popular open-source visual framework for building AI agents and RAG pipelines.

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

TheHackerNews · Jun 30, 2026

Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI)

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Industri4l-H3ll-Xpl0it3rs/CVE-2026-33017-Langflow-RCE

github · Created 2026-07-16 17:13:54 UTC · 0 stars

CVE-2026-33017 Exploit | by infrar3d

diamorphine666/CVE-2026-33017-Exploit

github · Created 2026-07-04 21:54:56 UTC · 0 stars

Unauthenticated RCE in Langflow <1.9.0 (CVE-2026-33017) Exploit

yayip/CVE-2026-33017

github · Created 2026-07-04 11:27:58 UTC · 0 stars

PoC of Langflow CVE-2026-33017

c0gnit00/CVE-2026-33017

github · Created 2026-07-02 09:47:58 UTC · 1 stars

Python POC, Exploit for CVE-2026-33017

r3nsi15/CVE-2026-33017-langflow-rce

github · Created 2026-05-22 22:01:05 UTC · 0 stars

EQSTLab/CVE-2026-33017

github · Created 2026-03-31 02:10:40 UTC · 3 stars

Langflow RCE

z4yd3/PoC-CVE-2026-33017

github · Created 2026-03-27 07:15:07 UTC · 3 stars

CVE-2026-33017: Unauthenticated RCE in Langflow

rootdirective-sec/CVE-2026-33017-Lab

github · Created 2026-03-26 04:49:07 UTC · 0 stars

omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC

github · Created 2026-03-21 17:06:34 UTC · 1 stars

The vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host.

MaxMnMl/langflow-CVE-2026-33017-poc

github · Created 2026-03-21 08:11:08 UTC · 7 stars

CVE-2026-33017 - An unauthenticated remote code execution in Langflow <= 1.8.1 via Public Flow Build Endpoint

Langflow < 1.9.0 - Remote Code Execution

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

14 Jul 2026 15:39 UTC 4 days ago

14 Jul 2026 15:39 UTC · 4 days ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
14 Jul 2026 15:39 UTC 4 days ago

14 Jul 2026 15:39 UTC · 4 days ago

Indicator of compromise added

Indicators of compromise recorded
2 Jun 2026 14:02 UTC about 2 months ago

2 Jun 2026 14:02 UTC · about 2 months ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
1 Jun 2026 15:34 UTC about 2 months ago

1 Jun 2026 15:34 UTC · about 2 months ago

Nuclei template available

Scanner coverage available
1 Jun 2026 12:26 UTC about 2 months ago

1 Jun 2026 12:26 UTC · about 2 months ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
31 Mar 2026 02:10 UTC 4 months ago

31 Mar 2026 02:10 UTC · 4 months ago

Public PoC available

Public proof-of-concept code published
20 Mar 2026 04:52 UTC 4 months ago

20 Mar 2026 04:52 UTC · 4 months ago

CVE published

Vulnerability disclosed publicly
17 Mar 2026 17:22 UTC 4 months ago

17 Mar 2026 17:22 UTC · 4 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-33017

{
  "cve_id": "CVE-2026-33017",
  "title": "Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endp...",
  "affected_vendor": "langflow-ai",
  "affected_product": "langflow",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.3,
  "epss_score": 0.98191,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-33017

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 7 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API