CVE-2026-33017: Langflow unauthenticated remote code execution in build_public_tmp endpoint

CVE-2026-33017 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-03-20

Langflow, a platform for building AI-driven workflows, contains a critical security flaw in how it handles public chatbot flows. An attacker can send a specially crafted request to a public endpoint that forces the server to execute malicious Python code. This allows an unauthorized user to take complete control of the server, steal sensitive API keys, or access private data without needing a password.

Technologies: Langflow, langflow (PyPI). Vendors: Langflow, PyPI.

Quick answers

Is CVE-2026-33017 exploited in the wild?
Yes. CVE-2026-33017 is known to be exploited in the wild, first recorded on 25 March 2026. Treat it as urgent.
How severe is CVE-2026-33017?
Critical severity, with a CVSS score of 9.8, published 20 March 2026.
Which products and versions are affected?
Langflow <= 1.8.2; langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.9.0.
Is there a fix for CVE-2026-33017?
Yes. langflow (PyPI): upgrade to 1.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33017 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-33017?
Check whether you run Langflow or langflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langflow (PyPI): upgrade to 1.9.0 or later
    pip install "langflow>=1.9.0"

Technical details

The 'POST /api/v1/build_public_tmp/{flow_id}/flow' endpoint in Langflow allows unauthenticated users to trigger a flow build. While intended for public flows, the endpoint incorrectly accepts an optional 'data' parameter containing attacker-controlled node definitions. This data is passed through the graph building process to 'prepare_global_scope' in 'validate.py', where arbitrary Python code within the node definitions is executed via 'exec()' without sandboxing. An attacker only needs the UUID of a public flow to achieve full remote code execution (RCE) with the privileges of the Langflow process. This is fixed in version 1.9.0 by ensuring public builds only use stored database data.

Affected products

  • langflow-ai Langflow <= 1.8.2

Identifiers

  • CVE-2026-33017
  • GHSA-vwmf-pq79-vjvx
  • PYSEC-2026-379

Timeline

  • 2026-03-16: advisory: GitHub Advisory GHSA-vwmf-pq79-vjvx published
  • 2026-03-17: disclosed: CVE-2026-33017 assigned
  • 2026-03-17: exploited: Reported exploitation in the wild within 20 hours of disclosure

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.