Langflow at a glance
Langflow's public flow build endpoint ran attacker-supplied Python without authentication in versions up to 1.8.2. CISA added CVE-2026-33017 to its KEV catalog on March 25, 2026. Upgrade to 1.9.0.
Langflow: status
- Affected
- Langflow 1.8.2 and earlier (CVE-2026-33017)
- Langflow 1.8.4 and earlier (CVE-2026-42048)
- Status as of
- Discovered by
- Reporter Aviral2642 (CVE-2026-33017); reporters ddlxstudio and nekros1xx (CVE-2026-42048)
What changed with Langflow
On March 16, 2026, Langflow published GHSA-vwmf-pq79-vjvx for CVE-2026-33017, rated critical (CVSS 4.0 score 9.3; NVD gives 9.8). The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint needs no login. If a caller added an optional data parameter, Langflow built the flow from that data instead of the stored one, and Python code inside node definitions was passed to exec() without a sandbox.
An attacker needs the ID of a public flow. With AUTO_LOGIN=true, the default, the advisory says an attacker can obtain a superuser token, create a public flow, and exploit it with no prior access. The result is full server compromise: commands, file access, and theft of environment variables and database contents. CISA added the bug to its Known Exploited Vulnerabilities catalog on March 25, 2026, with an April 8 federal deadline.
The fix is Langflow 1.9.0; the advisory lists 1.8.2 and earlier as affected. Version 1.9.0 also fixes CVE-2026-42048 (CVSS 9.6), a path traversal in the Knowledge Bases bulk delete API that let an authenticated user delete directories elsewhere on the server.
How to fix it: Langflow
Advisories
Where to compare Langflow
Independent leaderboards and official resources for comparing this model yourself. Rankings change often; each site shows its own current data.
Why Langflow matters for businesses
Langflow is a popular visual builder for AI agents and RAG apps, and its servers usually store LLM, vector database, and SaaS API keys. Default auto-login plus a public endpoint made this flaw easy to weaponize, so any Langflow instance reachable from the internet should be upgraded and placed behind authentication.
Sources for this story
- Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint (GHSA-vwmf-pq79-vjvx) (opens in a new tab)Official
Langflow on GitHub · github.com
- Path Traversal in Knowledge Bases API via Bulk Delete Endpoint (GHSA-9whx-c884-c68q) (opens in a new tab)Official
Langflow on GitHub · github.com
- CVE-2026-33017 Detail (opens in a new tab)Official
NIST National Vulnerability Database · nvd.nist.gov
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cve
- #langflow
- #cisa-kev
- #actively-exploited
- #agent-builders