CVE-2026-33017

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0

Description An unauthenticated remote code execution issue exists in the POST /api/v1/build public tmp/{flow id}/flow endpoint. The endpoint is designed to allow building public flows without authentication, but it incorrectly accepts an optional data parameter. When this parameter is provided, the system uses attacker-controlled flow data containing arbitrary Python code in node definitions instead of the data stored in the database. This code is processed by the exec() function without sandboxing, allowing an attacker to execute arbitrary commands on the server. Real-world exploitation has been observed, with attackers using the flaw to steal API keys, database credentials, and cloud metadata tokens. The execution chain involves the prepare global scope() function, which executes ast.Assign nodes during the graph building process.

Recommendations Update Langflow to version 1.9.0. As a temporary mitigation, remove the data parameter from the build public tmp endpoint to ensure public flows only use stored database data.