Langflow Public Flow Build Unauthenticated RCE
- Product
- Langflow Langflow
- CVE
- CVE-2026-33017
- Disclosed
- 2026-03-16
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Langflow < 1.9.0 (<= 1.8.2)
- Fixed
- 1.9.0
Summary
A second unauthenticated code-execution path in Langflow, distinct from CVE-2025-3248. The endpoint used to build public flows accepted attacker-supplied flow definitions containing Python, which the server then executed. CISA added it to KEV within days of disclosure.
Root cause
POST /api/v1/build_public_tmp/{flow_id}/flow is intentionally unauthenticated so public flows can run. When the optional 'data' parameter was supplied, the server used the attacker's flow graph instead of the stored one, and custom component code inside node definitions was passed to exec() with no sandbox. Only an arbitrary client_id cookie and a public flow UUID were needed; with AUTO_LOGIN enabled an attacker could also mint a superuser token and create their own public flow.
Impact
Unauthenticated remote code execution on the Langflow host and theft of stored LLM/API credentials.
Detection
Alert on POST requests to /api/v1/build_public_tmp/*/flow that carry a 'data' body with 'code' fields, and on GET /api/v1/auto_login from untrusted sources. Version check: < 1.9.0.
Mitigation
Upgrade to 1.9.0 or later, set LANGFLOW_AUTO_LOGIN=false, and keep Langflow off the public internet.