CVE-2026-33017: CWE-94: Improper Control of Generation of Code ('Code Injection') in langflow-ai langflow
On June 25, 2026, the first active exploitation of CVE-2026-55255, a critical CVSS 9.9 Langflow vulnerability, was documented. Langflow is an open-source framework for building AI agents and RAG pipelines. A single operator exploited both CVE-2026-55255 (cross-tenant IDOR) and CVE-2026-33017 (unauthenticated RCE, CVSS 9.3) against the same instance. Despite its lower score, the RCE has been exploited thousands of times and is listed in CISA KEV, while the IDOR showed no prior in-the-wild exploitation. The operator focused primarily on the RCE for code execution and implant delivery, using the IDOR opportunistically for credential theft across tenants. The financially motivated threat actor deployed a scripted loader to harvest AWS keys, environment files, and API credentials. This demonstrates that CVSS scores don't always correlate with real-world exploitation rates, as unauthenticated vulnerabilities require less effort than those needing authorization and disclosed object IDs.
AI Analysis
Technical Summary
CVE-2026-33017 is a critical vulnerability in langflow prior to version 1.9.0 where the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-controlled flow data containing arbitrary Python code. This code is executed using Python's exec() function without any sandboxing or validation, enabling unauthenticated remote code execution on the affected system. The vulnerability has been addressed and fixed in langflow version 1.9.0.
Potential Impact
An unauthenticated attacker can remotely execute arbitrary Python code on the vulnerable system by sending specially crafted requests to the affected endpoint. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade langflow to version 1.9.0 or later, where this vulnerability is fixed. No other mitigations are indicated or required as the fix addresses the root cause by preventing execution of arbitrary code via the vulnerable endpoint.
Indicators of Compromise
- cve: CVE-2026-33017
- cve: CVE-2026-55255
- url: http://45.207.216.55:8084/slt
CVE-2026-33017: CWE-94: Improper Control of Generation of Code ('Code Injection') in langflow-ai langflow
Description
On June 25, 2026, the first active exploitation of CVE-2026-55255, a critical CVSS 9.9 Langflow vulnerability, was documented. Langflow is an open-source framework for building AI agents and RAG pipelines. A single operator exploited both CVE-2026-55255 (cross-tenant IDOR) and CVE-2026-33017 (unauthenticated RCE, CVSS 9.3) against the same instance. Despite its lower score, the RCE has been exploited thousands of times and is listed in CISA KEV, while the IDOR showed no prior in-the-wild exploitation. The operator focused primarily on the RCE for code execution and implant delivery, using the IDOR opportunistically for credential theft across tenants. The financially motivated threat actor deployed a scripted loader to harvest AWS keys, environment files, and API credentials. This demonstrates that CVSS scores don't always correlate with real-world exploitation rates, as unauthenticated vulnerabilities require less effort than those needing authorization and disclosed object IDs.
CVSS v4.0
Score 9.3critical
Affected software
pkg:github/langflow-ai/langflowRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-33017 is a critical vulnerability in langflow prior to version 1.9.0 where the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepts attacker-controlled flow data containing arbitrary Python code. This code is executed using Python's exec() function without any sandboxing or validation, enabling unauthenticated remote code execution on the affected system. The vulnerability has been addressed and fixed in langflow version 1.9.0.
Potential Impact
An unauthenticated attacker can remotely execute arbitrary Python code on the vulnerable system by sending specially crafted requests to the affected endpoint. This can lead to full system compromise, data theft, or disruption of service. The CVSS 4.0 base score is 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade langflow to version 1.9.0 or later, where this vulnerability is fixed. No other mitigations are indicated or required as the fix addresses the root cause by preventing execution of arbitrary code via the vulnerable endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-17T17:22:14.666Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Indicators of Compromise
Cve
| Value | Description | Copy |
|---|---|---|
cveCVE-2026-33017 | — | |
cveCVE-2026-55255 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://45.207.216.55:8084/slt | — |
Threat ID: 69bcda04e32a4fbe5f304681
Added to database: 03/20/2026, 05:24:20 UTC
Last enriched: 07/29/2026, 20:52:36 UTC
Last updated: 08/02/2026, 19:17:58 UTC
Views: 269
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.