CVE-2026-33017: Langflow build_public_tmp endpoint unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a CVSS 4.0 score of 9.3, KEV listing and very high EPSS probability, with evidence of active exploitation.

What it is

Langflow versions prior to 1.9.0 expose the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint without authentication, and when the optional data parameter is supplied the endpoint executes attacker-controlled flow data instead of the stored flow. Node definitions in that data can contain arbitrary Python that is passed to exec() with no sandboxing, giving unauthenticated remote code execution. It is a distinct flaw from CVE-2025-3248, which only added authentication to /api/v1/validate/code.

Impact

An unauthenticated attacker gains arbitrary code execution in the context of the Langflow server, allowing full compromise of the host and any AI pipelines, credentials or data it can reach.

Attack surface

Reachable over the network via a single POST to the public build endpoint; no authentication and no user interaction are required, as reflected in the CVSS 4.0 vector (AV:N/PR:N/UI:N). The attacker only needs to supply crafted flow data in the optional data parameter.

Exploitation

CISA added it to KEV on 2026-03-25 with a remediation due date of 2026-04-08, and EPSS gives a 30-day probability of 0.96177 (99.875th percentile). Vendor and third-party references are tagged Exploit, and media reporting describes real-world compromise of Langflow pipelines, so exploitation is active.

What to do

• Upgrade Langflow to 1.9.0 or later, which contains the fix.
• If immediate upgrade is not possible, block or restrict external access to /api/v1/build_public_tmp/ and any public flow build endpoints at the reverse proxy or firewall.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud-hosted instances, or discontinue use of the product where mitigations are unavailable.
• Rotate any credentials, API keys and secrets accessible to the Langflow process, and review the host for signs of compromise.
• Run Langflow with least privilege and isolate it from sensitive internal networks until patched.

Detection

• Monitor web and proxy logs for POST requests to /api/v1/build_public_tmp/*/flow, especially with a data parameter in the body.
• Look for unexpected child processes spawned by the Langflow service (python, sh, bash, curl, wget) indicating exec() abuse.
• Alert on outbound network connections from Langflow hosts to unfamiliar destinations, consistent with post-exploitation activity.
• Audit Langflow flow definitions and server filesystem for injected Python code or newly created files and persistence.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.