CVE-2026-33017

Deeper analysis

Langflow, a framework for building and deploying AI-powered agents and workflows, contains an unauthenticated remote code execution vulnerability in versions prior to 1.9.0. The flaw resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is intentionally reachable without authentication for public flows. When an optional data parameter is supplied, the endpoint substitutes attacker-controlled flow definitions—containing arbitrary Python code in node definitions—for the stored database record and passes the input directly to an unsandboxed exec() call.

An unauthenticated attacker can therefore submit a malicious flow payload to achieve arbitrary code execution on the server, obtaining full control over the host process, data, and any connected resources. The issue stems from missing authentication combined with insufficient validation of externally supplied flow data, distinct from the earlier CVE-2025-3248 fix that added authentication to the /api/v1/validate/code endpoint.

Public advisories and the project repository indicate that the vulnerability is resolved in Langflow 1.9.0; the referenced commit and release notes document the corrective changes that prevent the endpoint from accepting and executing attacker-supplied code.

The affected component is central to AI workflow tooling, increasing the potential blast radius in environments that expose Langflow instances. Exploitation probability rose from lower values to a peak of 0.4365 on 2026-05-12 before receding to the current 0.2465, indicating post-disclosure attacker interest.