Case langflow-cve-2026-33017-exploitedAI supply chainWorldwide
Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory
A public flow build endpoint in Langflow before 1.9.0 ran attacker-supplied Python with no login; Sysdig honeypots saw scanning, reconnaissance and environment-variable theft within a day of disclosure and CISA added it to KEV.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Mar 25, 2026
- Location
- Worldwide
- Target
- Langflow AI pipeline servers
- Severity
- Critical
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- CVE-2026-33017
What happened
A public flow build endpoint in Langflow before 1.9.0 ran attacker-supplied Python with no login; Sysdig honeypots saw scanning, reconnaissance and environment-variable theft within a day of disclosure and CISA added it to KEV.
Impact: Unauthenticated code execution on exposed Langflow servers; attackers dumped environment variables and searched for .env and .db secrets
Who triggered it
Actor: Unknown
Attribution: Six source IPs observed by Sysdig, two sharing a C2 server; no named group
Motive: Credential harvesting and footholds on AI pipeline hosts
How it happened
Attack vector: Single POST to /api/v1/build_public_tmp/{flow_id}/flow with node definitions containing arbitrary Python passed to exec()
Root cause: Endpoint built flows without authentication and trusted attacker-controlled flow data instead of stored flows
Timeline
- Langflow publishes GHSA-vwmf-pq79-vjvx; fixed in 1.8.2 and 1.9.0
- First exploitation attempt about 20 hours later, followed by nuclei scanning and env-var exfiltration
- CISA adds CVE-2026-33017 to the KEV catalog
Response
Upgrade to 1.9.0 or later; Sysdig published IOCs and callback domains
Current status: Patched
Sources (open in a new tab)
- CISA KEV cisa.gov
- Langflow advisory github.com
- Sysdig sysdig.com
Cite this case
Langflow unauthenticated RCE (CVE-2026-33017) exploited within 20 hours of advisory. AI Threat Watch, case langflow-cve-2026-33017-exploited, Mar 25, 2026. https://aithreat.io/cases/langflow-cve-2026-33017-exploited/
Permanent link: https://aithreat.io/cases/langflow-cve-2026-33017-exploited/