Skip to content
skopnix

Actively exploited · CISA KEV · NVD published 2026-03-20

CVE-2026-33017

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

  1. First PoC
  2. 4 days →KEV
  3. 140 days →Metasploit

Signals

Exploited in the wild
Yesadded 2026-03-25 · due 2026-04-08. An observation, not a forecast.
EPSS · 30-day forecast
25%Chance of exploitation in the next 30 days, 98th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

30 known · links only

GitHub PoCs · by trust, then stars27

  1. EQSTLab/CVE-2026-33017 ↗Trust ok 100

    Langflow RCE

    ★ 11 · created 2026-03-31

  2. MaxMnMl/langflow-CVE-2026-33017-poc ↗Trust ok 100

    CVE-2026-33017 - An unauthenticated remote code execution in Langflow <= 1.8.1 via Public Flow Build Endpoint

    ★ 10 · created 2026-03-21

  3. z4yd3/PoC-CVE-2026-33017 ↗Trust ok 100

    CVE-2026-33017: Unauthenticated RCE in Langflow

    ★ 5 · created 2026-03-27

  4. c0gnit00/CVE-2026-33017 ↗Trust ok 100

    Python POC, Exploit for CVE-2026-33017

    ★ 2 · created 2026-07-02

  5. CerberusMrXi/Langflow-cve-2026-33017-exploit ↗Trust ok 100

    CVE-2026-33017 exploitation tool for Langflow <1.9.0. Features reverse shells, command execution, file operations, persistence, and automated testing. Validates critical RCE vulnerability impact. For authorized security assessments only.

    ★ 2 · created 2026-07-19

  6. e4zyy/Project-CVE-2026-33017 ↗Trust ok 100

    CVE-2026-33017 - Langflow Unauthenticated RCE Exploit

    ★ 1 · created 2026-08-28

  7. Jorrit-VM/CVE-2026-33017 ↗Trust ok 100

    ★ 1 · created 2026-04-20

  8. lxxexxbxx/CVE-2026-33017 ↗Trust ok 100

    CVE-2026-33017: Langflow Unauthenticated RCE PoC

    ★ 1 · created 2026-08-13

  9. omer-efe-curkus/CVE-2026-33017-Langflow-RCE-PoC ↗Trust ok 100

    The vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host.

    ★ 1 · created 2026-03-21

  10. yym8538/CVE-2026-33017 ↗Trust ok 100

    ★ 1 · created 2026-08-21

  11. 0xBlackash/CVE-2026-33017 ↗Trust ok 100

    CVE-2026-33017

    ★ 0 · created 2026-04-19

  12. 1337or420/CVE-2026-33017-Langflow-RCE ↗Trust ok 100

    CVE-2026-33017 Exploit | by infrar3d

    ★ 0 · created 2026-07-17

  13. ahseven/CVE-2026-33017-PoC-Reverse-Shell ↗Trust ok 100

    CVE-2026-33017 PoC Reverse Shell

    ★ 0 · created 2026-08-28

  14. arensballiu/CVE-2026-33017-langflow-rce ↗Trust ok 100

    Proof-of-concept for CVE-2026-33017, demonstrating unauthenticated remote code execution in vulnerable Langflow versions through malicious CustomComponent code injection.

    ★ 0 · created 2026-05-22

  15. diamorphine666/CVE-2026-33017-Exploit ↗Trust ok 100

    Unauthenticated RCE in Langflow <1.9.0 (CVE-2026-33017) Exploit

    ★ 0 · created 2026-07-04

  16. Dynamo2k1/CVE-2026-33017 ↗Trust ok 100

    ★ 0 · created 2026-07-23

  17. Industri4l-H3ll-Xpl0it3rs/CVE-2026-33017-Langflow-RCE ↗Trust ok 100

    CVE-2026-33017 Exploit | by infrar3d

    ★ 0 · created 2026-10-16

  18. masterwok/PoC-CVE-2026-33017 ↗Trust ok 100

    Proof-of-concept exploit for CVE-2026-33017 (Langflow <= 1.8.1).

    ★ 0 · created 2026-04-07

  19. MaximilianoMeyer/CVE-2026-33017 ↗Trust ok 100

    Simple Proof Of Concept about CVE 2026-33017

    ★ 0 · created 2026-09-11

  20. maxprog-svg/CVE-2026-33017 ↗Trust ok 100

    CVE-2025-62593 — Ray Unauthenticated RCE Exploit is an unauthenticated remote code execution vulnerability in the Ray distributed AI compute engine.

    ★ 0 · created 2026-09-01

  21. Oieua/CVE-2026-33017 ↗Trust ok 100

    My implementation of the

    ★ 0 · created 2026-09-14

  22. rootdirective-sec/CVE-2026-33017-Lab ↗Trust ok 100

    ★ 0 · created 2026-03-26

  23. SimoesCTT/Sovereign-Echo-33017 ↗Trust ok 100

    Resonant RCE for CVE-2026-33017 via CTT Phase-Lock. Exploits Langflow build_public_tmp flow_id endpoint. Bypasses auth using 34th-layer negative refraction to inject Python exec() payloads. Calibrated for 16.6fs jitter resonance and g-coupling g \approx 0.733. O(log N) collapse of AI supply chain security.

    ★ 0 · created 2026-03-21

  24. sonnelon/CVE-2026-33017-PoC ↗Trust ok 100

    The poc of CVE-2026-33017

    ★ 0 · created 2026-08-13

  25. TatoSec/CVE-2026-33017-Langflop ↗Trust ok 100

    CVE-2026-33017 Langflow RCE PoC

    ★ 0 · created 2026-08-05

  26. Usman0220/CVE-2026-33017-Langflow-RCE ↗Trust ok 100

    CVE-2026-33017 - Langflow < 1.9.0 Unauthenticated RCE PoC

    ★ 0 · created 2026-07-08

  27. yayip/CVE-2026-33017 ↗Trust ok 100

    PoC of Langflow CVE-2026-33017

    ★ 0 · created 2026-07-04

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

Metasploit1

  1. Langflow Unauth RCE ↗

    Langflow versions prior to 1.9.0 are susceptible to unauthenticated remote code execution through the /api/v1/build_public_tmp/<flow_id>/flow endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.

    ruby · seen 2026-10-18

Exploit-DB1

  1. Langflow 1.9.0 - RCE ↗

    created 2026-07-08

Nuclei1

  1. Langflow < 1.9.0 - Remote Code Execution ↗

    Langflow versions prior to 1.9.0 are vulnerable to unauthenticated remote code execution (RCE) via the build_public_tmp endpoint. Attackers can submit a manipulated flow JSON containing Python code that is executed during the build process without proper sandboxing.

    yaml · seen 2026-10-18

On the wire

1 dispatch
  1. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.