CVE-2026-33017: Langflow Code Injection Vulnerability

Vulnerability summary

CVE-2026-33017 is a critical (CVSS 9.8) Code Injection vulnerability in Langflow. It is known to be exploited: CISA lists it, first on 25-03-2026. EPSS estimates a 24.75% chance of exploitation in the next 30 days, higher than 97.8% of scored vulnerabilities. 4 public exploits are recorded.

Timeline

1. 20-03-2026
   PublishedVulnerability first disclosed.
2. 25-03-2026
   Added to CISA KEVLangflow Code Injection Vulnerability
3. 08-04-2026
   CISA remediation dueApply mitigations per vendor instructions.
4. 21-05-2026
   Last modifiedVulnerability information updated.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.