CVE-2026-33017: Langflow unauthenticated remote code execution in build_public_tmp endpoint

Executive brief

Langflow, a platform for building AI-driven workflows, contains a critical security flaw in how it handles public chatbot flows. An attacker can send a specially crafted request to a public endpoint that forces the server to execute malicious Python code. This allows an unauthorized user to take complete control of the server, steal sensitive API keys, or access private data without needing a password.

Technical details

The 'POST /api/v1/build_public_tmp/{flow_id}/flow' endpoint in Langflow allows unauthenticated users to trigger a flow build. While intended for public flows, the endpoint incorrectly accepts an optional 'data' parameter containing attacker-controlled node definitions. This data is passed through the graph building process to 'prepare_global_scope' in 'validate.py', where arbitrary Python code within the node definitions is executed via 'exec()' without sandboxing. An attacker only needs the UUID of a public flow to achieve full remote code execution (RCE) with the privileges of the Langflow process. This is fixed in version 1.9.0 by ensuring public builds only use stored database data.

Affected products

• langflow-ai Langflow <= 1.8.2

Timeline

• 2026-03-16: advisory: GitHub Advisory GHSA-vwmf-pq79-vjvx published
• 2026-03-17: disclosed: CVE-2026-33017 assigned
• 2026-03-17: exploited: Reported exploitation in the wild within 20 hours of disclosure

References

• https://api.github.com/users/Aviral2642
• https://github.com/Aviral2642
• https://api.github.com/users/Aviral2642/gists%7B/gist_id%7D
• https://api.github.com/users/Aviral2642/repos
• https://avatars.githubusercontent.com/u/26358686?v=4
• https://api.github.com/users/Aviral2642/events%7B/privacy%7D