CVE-2026-33017

Langflow public-flow builder accepts executable attacker data

Langflow · Langflow public flow builder

First documented disclosure · Review checkpoint

Summary

The public-flow build endpoint could accept executable flow definitions without authentication.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Reported activity: CISA lists this CVE in its Known Exploited Vulnerabilities catalog, added 2026-03-25. The catalog does not establish victim counts or exploitation of every affected deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server used caller-supplied node definitions instead of the stored public flow.

Conditions required

A reachable public flow with a known identifier; automatic login can further expose flow creation.

Potential impact

Arbitrary execution with the Langflow service’s privileges and access to its credentials.

Affected versions and configurations

CNA: before 1.9.0; the upstream advisory originally listed through 1.8.2.

Fix and mitigation status

1.9.0.

Practical next steps

Upgrade and restrict public-flow building; disable automatic login and investigate exposed instances.

Operating lesson

Public execution interfaces should operate on trusted stored definitions, not replacement code from callers.

Evidence and limits

March 16 is upstream disclosure; March 20 is CVE publication. This is a distinct path from the older CVE-2025-3248.

Sources