Langflow public flow build endpoint allows unauthenticated RCE
Langflow < 1.9.0: public flow build endpoint accepts attacker-supplied Python code passed to exec() with no sandboxing — unauthenticated RCE. CVSS 9.8 critical.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 9.8
- EPSS (exploit probability)
- 24.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-33017 being exploited?
Yes. CISA added CVE-2026-33017 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 24.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow allows building public flows without authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data — which can contain arbitrary Python code in node definitions — instead of the stored flow from the database. That code is passed directly to exec() with no sandboxing. An unauthenticated attacker with network access to the Langflow instance can achieve full remote code execution.
This is distinct from CVE-2025-3248, which fixed the /api/v1/validate/code endpoint by adding authentication. The build_public_tmp endpoint is intentionally unauthenticated (for public flows) but incorrectly trusts attacker-supplied flow data containing executable code.
CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog on 2026-03-25. Source: NVD.
Affected versions
Langflow versions prior to 1.9.0.
What to do
Upgrade to Langflow 1.9.0 or later. Any public-facing Langflow instance below 1.9.0 is exposed. If upgrading immediately is not possible, take the instance off the public internet — bind to a VPN or apply ingress ACLs. No WAF rule meaningfully mitigates an unauthenticated RCE in a legitimate platform endpoint; ingress restriction is the mitigation.
Langflow has five KEV entries in fourteen months. If you’re still on a pre-1.9.0 build, you’re carrying multiple critical paths. Upgrade the whole stack, not just the one CVE that prompted the alert.
Other Langflow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-105740 Authenticated RCE via MCP tool additionwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2026-0768 Langflow Unauthenticated RCE via Code Execution Endpointwrite-up | [ CRITICAL ] | 9.8 | 22.9% | — |
| CVE-2026-0770 Langflow validate-endpoint exec_globals RCE (unauthenticated)write-up | [ CRITICAL ] | 9.8 | 62.6% | |
| CVE-2026-55255 Langflow /api/v1/responses IDOR — cross-user flow executionwrite-up | [ HIGH ] | 8.4 | 0.9% | |
| CVE-2025-34291 Langflow CORS misconfiguration enables CSRF-driven token theft and RCEwrite-up | [ HIGH ] | 8.8 | 92.8% | |
| CVE-2025-3248 Langflow unauthenticated code injection in validate/code endpointransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
