CVE-2026-33017: Critical Langflow Vulnerability Exploited Within 20 Hours of Disclosure

The discovery of CVE-2026-33017 reveals a critical remote code execution vulnerability in Langflow that is being actively exploited in the wild within 20 hours of public disclosure. Successful exploitation could allow unauthenticated attackers to execute arbitrary code on affected servers, potentially leading to full system compromise across exposed Langflow deployments.

A critical vulnerability, tracked as has been identified in Langflow affecting versions up to and including 1.8.1. The issue arises from a combination of a missing authentication check and unsafe code execution.

The endpoint is designed to allow building of public flows without authentication. However, when the optional data parameter is supplied, the application processes attacker-controlled flow definitions instead of retrieving trusted data from the database.

In practical terms, this means:

• Attackers can supply malicious flow data without authentication
• Python code embedded in nodes is processed directly by the application
• The application executes this code using Python’s exec() function
• No sandboxing or input validation is applied

When combined, these conditions result in unauthenticated remote code execution (RCE) on the affected system.

The vulnerability originates from insecure design choices in the “public flows” feature:

• The endpoint is exposed without authentication
• The data parameter allows external flow injection
• Flow definitions are not strictly separated from trusted database content
• User-controlled input is passed directly to exec()
• No sandboxing, filtering, or execution isolation is implemented

Successful exploitation allows attackers to execute arbitrary commands with the privileges of the Langflow server process.

This can result in:

• Access to environment variables containing API keys and secrets
• Unauthorized file system access and modification
• Deployment of persistent backdoors
• Execution of reverse shells for remote control
• Full compromise of the affected Langflow instance

Because the flaw is unauthenticated and requires minimal input, it is considered highly exploitable in real-world environments, especially when exposed to the internet.

• Langflow versions earlier and equal to 1.8.1

To reduce risk , the following actions are recommended:

• Review and audit all environment variables and stored secrets
• Rotate exposed API keys, credentials, and database passwords
• Monitor outbound traffic for suspicious connections or callbacks
• Restrict public access using firewall rules or reverse proxy authentication

The observed attacks involve several tactics, techniques, and procedures (TTPs) commonly used by threat actors. These include:

• TA0001 – Initial Access: Exploiting a public-facing application to gain initial entry into the system.
• T1190 – Exploit Public-Facing Application: Leveraging a known vulnerability in Langflow to execute arbitrary code.
• TA0002 – Execution: Using command and scripting interpreters to run malicious code.
• T1059.002 – Command and Scripting Interpreter: AppleScript: Although not explicitly mentioned, attackers often use scripting languages to automate post-exploitation tasks.
• TA0006 – Credential Access: Attempting to steal credentials through various means.
• T1003 – OS Credential Dumping: Extracting user credentials from the operating system.
• TA0007 – Discovery: Gathering information about the system and network environment.
• T1083 – File and Directory Discovery: Identifying sensitive files and directories.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.