Langflow public flow build endpoint allows unauthenticated RCE
Langflow < 1.9.0: public flow build endpoint accepts attacker-supplied Python code passed to exec() with no sandboxing — unauthenticated RCE. CVSS 9.8 critical.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 9.8
- EPSS (exploit probability)
- 96.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow allows building public flows without authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data — which can contain arbitrary Python code in node definitions — instead of the stored flow from the database. That code is passed directly to exec() with no sandboxing. An unauthenticated attacker with network access to the Langflow instance can achieve full remote code execution.
This is distinct from CVE-2025-3248, which fixed the /api/v1/validate/code endpoint by adding authentication. The build_public_tmp endpoint is intentionally unauthenticated (for public flows) but incorrectly trusts attacker-supplied flow data containing executable code.
CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog on 2026-03-25. Source: NVD.
Affected versions
Langflow versions prior to 1.9.0.
What to do
Upgrade to Langflow 1.9.0 or later. Any public-facing Langflow instance below 1.9.0 is exposed. If upgrading immediately is not possible, take the instance off the public internet — bind to a VPN or apply ingress ACLs. No WAF rule meaningfully mitigates an unauthenticated RCE in a legitimate platform endpoint; ingress restriction is the mitigation.
Langflow has five KEV entries in fourteen months. If you’re still on a pre-1.9.0 build, you’re carrying multiple critical paths. Upgrade the whole stack, not just the one CVE that prompted the alert.
