CVE-2026-33017

Overview

CVE-2026-33017 is an unauthenticated remote code execution (RCE) vulnerability in Langflow, a popular tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of stored flow data. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution.

Relation to CVE-2025-3248 & Why This Is Distinct

This vulnerability is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. That earlier CVE was itself added to CISA's KEV catalog due to active exploitation.

Vulnerability Description

Unauthenticated remote code execution in Langflow via the public flow build endpoint.

The root cause is a combination of CWE-94 (Code Injection), CWE-95 (Eval Injection), and CWE-306 (Missing Authentication for Critical Function). The vulnerable endpoint /api/v1/build_public_tmp/{flow_id}/flow is designed to be unauthenticated for building public flows. However, when the optional data parameter is supplied, the endpoint uses attacker-controlled flow data instead of stored database data. The attacker's flow data contains arbitrary Python code in node definitions, which flows through the graph builder:

1. start_flow_build(data=attacker_data) → generate_flow_events()
2. create_graph() → build_graph_from_data(payload=data)
3. Graph.from_payload() → node initialization → instantiate_class()
4. eval_custom_component_code(code) → create_class()
5. prepare_global_scope() → exec(compiled_code, exec_globals)

The exec() call has zero sandboxing — any Python code is executed with full server process privileges. Even simple assignment statements (e.g., _x = os.system("id")) are executed during graph building, before the flow even "runs."

Prerequisites for Exploitation

Affected Products & Versions

Impact

Exploitation Details

Exploitation is trivially simple. A single unauthenticated HTTP POST request with a crafted data parameter containing a malicious node definition is sufficient.

Attack Flow

1. Attacker identifies a Langflow instance with a public flow (or creates one via AUTO_LOGIN).
2. Attacker sends a POST request to /api/v1/build_public_tmp/{flow_id}/flow with a data parameter containing a node whose code field holds arbitrary Python.
3. Langflow's graph builder parses the attacker's node definitions and calls prepare_global_scope() → exec() on the code.
4. Attacker's Python code executes with full server process privileges — during graph building, before the flow even "runs."
5. Attacker achieves arbitrary command execution, credential exfiltration, or reverse shell.

Mitigation & Remediation

Patched Version

Recommended Actions

1. Upgrade immediately to Langflow 1.9.0 or later.
2. Disable AUTO_LOGIN — set AUTO_LOGIN=false if not already done. The default AUTO_LOGIN=true setting allows unauthenticated users to create public flows, making exploitation trivial even without pre-existing public flows.
3. Restrict network access — if patching is not immediately possible, restrict access to the Langflow instance to trusted networks only. Do not expose Langflow directly to the internet.
4. Review server logs — check for suspicious POST requests to /api/v1/build_public_tmp/ endpoints, especially those with a data parameter containing code fields.
5. Rotate credentials — if exploitation is suspected, rotate all API keys, database credentials, cloud tokens, and other secrets accessible to the Langflow server process.
6. Monitor CISA KEV Catalog for updated guidance.