CVE-2026-33017

Langflow, a visual builder for AI agents and workflows, exposes a POST /api/v1/build_public_tmp/{flow_id}/flow endpoint that is intentionally unauthenticated so public flows can be built. The flaw is that when the optional data parameter is supplied, the endpoint trusts that attacker-controlled flow data instead of the stored flow from the database. Flow node definitions can contain Python code, and that code is handed to exec() with no sandboxing, so an unauthenticated attacker who posts a crafted flow achieves direct remote code execution on the server.

Langflow instances are increasingly stood up to prototype and host AI agent workflows, often exposed to the network for collaboration and not hardened as production services, and they frequently hold API keys and credentials for the model providers and tools the flows orchestrate. That makes an unauthenticated RCE a straightforward path to both server compromise and secret theft. Upgrade to Langflow 1.9.0 or later, and until then keep any instance off the public internet and behind an authenticating proxy. Because the vulnerable endpoint is unauthenticated by design, review exposed servers for unexpected processes and exfiltration of stored credentials.