CVE-2026-33017

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.9.0

Description An unauthenticated remote code execution issue exists in the tool used for building AI-powered agents and workflows. The 'POST /api/v1/build public tmp/{flow id}/flow' endpoint allows the creation of public flows without authentication. If the optional data parameter is provided, the system uses attacker-controlled flow data containing arbitrary Python code in node definitions instead of the data stored in the database. This code is processed by the exec() function without sandboxing, allowing an attacker to execute arbitrary commands on the server. Real-world exploitation has been observed, where attackers used the vulnerability to steal API keys, database credentials, and cloud metadata tokens. The attack chain involves using the prepare global scope() function to execute malicious assignments during the graph building process.

Recommendations Update Langflow to version 1.9.0. As a temporary mitigation, remove the data parameter from the 'POST /api/v1/build public tmp/{flow id}/flow' endpoint to ensure public flows only use stored database data.