Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Langflow exposes POST /api/v1/build_public_tmp/{flow_id}/flow so that anonymous users can render public flows in the visual builder. The handler accepts attacker-supplied node definitions and instantiates them server-side — meaning arbitrary Python embedded in node code, default arguments, or decorators is exec()'d in the Langflow worker process with whatever privileges the service runs as (usually the container's root or the host's langflow user). All versions ≤ 1.8.2 are affected; the fix lands in 1.9.0, which adds authentication and input validation on the public-build path. This is the second time the same exec() pattern has bitten Langflow — CVE-2025-3248 was the first round on /api/v1/validate/code.

Vendor severity (CRITICAL / 9.3) is accurate and arguably understated. CVSS 4.0 captures the trivial reachability (AV:N/AC:L/PR:N/UI:N) but the real-world story is worse: KEV listing, EPSS 0.984, observed mass scanning, Monero miner payloads in the wild within 20 hours of advisory publication, and a target population (Langflow servers) that is almost always internet-exposed by design because operators want their RAG agents reachable. There is no friction to audit away.

Why this verdict

• Unauthenticated and pre-auth reachable — no credentials, no session, no user interaction; a single POST to /api/v1/build_public_tmp/{flow_id}/flow is the entire chain
• KEV-listed with EPSS 0.984 — CISA flagged it within weeks of disclosure; federal patch deadline already issued
• Active exploitation within 20 hours of advisory publication (Sysdig TRT), with XMRig miner payloads and credential theft already observed
• Role multiplier: Langflow hosts the orchestration plane for RAG/agent pipelines — code execution there yields API keys (OpenAI/Anthropic/Azure), vector DB credentials, and access to enterprise data sources feeding the agents. Even on a 'low-value' dev instance the blast radius reaches the model-provider billing account and any data the agent retrieves
• Role multiplier: in production AI-agent deployments Langflow sits adjacent to internal data stores (Postgres, S3, Snowflake connectors) — the chain ends in enterprise data egress, not just one host
• Internet-exposure is the design pattern — operators deploy Langflow to serve agents; the assumption that 'most instances are internal' does not hold here as it does for ESXi or DCs

Why not higher?

CRITICAL is already the top bucket. We score 9.6 rather than the 10.0 ceiling because the immediate blast radius is the Langflow process itself — fleet-scale impact requires the secrets and connectors that the box holds, which is high-probability but not automatic.

Why not lower?

Downgrading to HIGH would require either authentication friction, an exposure population below 1%, or a containment story (sandboxing, non-root execution) — none apply. Langflow is deployed to be reachable, the endpoint is anonymous, and the code runs in the main worker. The KEV listing and EPSS 0.984 alone make a sub-CRITICAL call indefensible.

1. Block the public build endpoint at the reverse proxy NOW — Add a deny rule for ^/api/v1/build_public_tmp/ on your nginx/Traefik/ALB in front of Langflow until you can deploy 1.9.0. This is the surest pre-patch mitigation and ships in under an hour. Per noisgate mitigation SLA for CRITICAL + active KEV exploitation: deploy within hours, not days.
2. Take internet-exposed Langflow instances offline or behind VPN — If you cannot patch within hours, pull the Langflow ingress from the public internet and re-front it with an auth proxy (Cloudflare Access, Pomerium, oauth2-proxy). Active mass exploitation means every hour of public exposure is a live compromise window.
3. Egress-restrict Langflow workers — Outbound allowlist to only the model-provider APIs you actually use (api.openai.com, api.anthropic.com, your vector DB). Kills the miner-download and reverse-shell steps even if RCE lands. Apply within the mitigation window (hours), keep permanently.
4. Rotate all secrets held by Langflow — If your instance was internet-facing for any window after March 17, 2026, assume compromise. Rotate OpenAI/Anthropic/Azure keys, DB creds, and any OAuth client secrets stored in Langflow's .env or component configs. Do this in parallel with patching, not after.
5. Hunt for indicators — Check for outbound to known XMRig pools, unusual python child processes (sh, curl, wget), and recent writes to /tmp or ~/.cache on Langflow hosts. Sysdig and SonicWall have published IOCs; ingest them into your SIEM.

Run on an auditor workstation or CI runner with network reach to the Langflow host. Usage: ./check_langflow.sh https://langflow.example.com. No privileges required; only outbound HTTP to the target.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-33017 (Langflow unauthenticated RCE)
# Outputs: VULNERABLE | PATCHED | UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <https://langflow-host>" >&2
  exit 2
fi

# 1. Try to read the version endpoint (unauth on all versions)
VER_JSON="$(curl -sk --max-time 10 "$TARGET/api/v1/version" || true)"
VERSION="$(echo "$VER_JSON" | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"$/\1/')"

if [[ -n "$VERSION" ]]; then
  # semver compare against 1.9.0
  IFS='.' read -r MAJ MIN PAT <<<"${VERSION%%[-+]*}"
  MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}
  if (( MAJ > 1 )) || { (( MAJ == 1 )) && (( MIN >= 9 )); }; then
    echo "PATCHED (version $VERSION >= 1.9.0)"
    exit 0
  else
    echo "VULNERABLE (version $VERSION < 1.9.0)"
    exit 1
  fi
fi

# 2. Fallback: probe the vulnerable endpoint with a benign payload
#    A 200/422 (request reached the handler) on an unauthenticated POST
#    to build_public_tmp indicates the public build path is enabled.
PROBE_BODY='{"data":{"nodes":[],"edges":[]}}'
CODE="$(curl -sk -o /dev/null -w '%{http_code}' --max-time 10 \
  -X POST -H 'Content-Type: application/json' \
  -d "$PROBE_BODY" \
  "$TARGET/api/v1/build_public_tmp/00000000-0000-0000-0000-000000000000/flow" || true)"

case "$CODE" in
  200|202|400|422)
    echo "VULNERABLE (public build endpoint reachable unauthenticated; HTTP $CODE)"
    exit 1 ;;
  401|403|404)
    echo "PATCHED (public build endpoint not reachable unauthenticated; HTTP $CODE)"
    exit 0 ;;
  *)
    echo "UNKNOWN (HTTP $CODE from build endpoint, no version metadata)"
    exit 3 ;;
esac

Sources

1. GitHub Security Advisory GHSA-vwmf-pq79-vjvx
2. Sysdig — Compromised in 20 hours
3. SonicWall — Langflow AI Code Injection to RCE
4. RAXE Labs RAXE-2026-043 advisory
5. Aviral Srivastava — researcher writeup
6. The Hacker News — Monero miner exploitation
7. Wiz vulnerability database — CVE-2026-33017
8. CSO Online — CISA sounds alarm