Loading story…
Threat actors rapidly exploited CVE-2026-33017, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed exec() path with a single crafted request. The bug affects Langflow versions prior to 1.9.0 and stems from the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from CVE-2025-3248 because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication.
Sysdig and other researchers reported exploitation beginning within about 20 hours of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as .env, .db, and /etc/passwd, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including 173.212.205[.]251:8443. The severity prompted CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to remediate by April 8, 2026 or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to Langflow 1.9.0 or later, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
After adding the flaw to KEV, CISA directed Federal Civilian Executive Branch agencies to remediate CVE-2026-33017 by April 8, 2026. Guidance also said agencies should discontinue use if mitigations could not be applied.
Threat actors exploited CVE-2026-33017 in attacks observed from March 27 to April 15, 2026 to deploy a Monero cryptominer via a Python payload and shell-script dropper. The campaign installed a Go-based ELF binary called "lambsys" that killed rival miners, disabled security controls, established cron persistence, removed logs, and spread laterally using reused SSH keys.
CISA added the Langflow flaw to its Known Exploited Vulnerabilities catalog after determining it was being actively exploited in the wild. The agency's action elevated the issue for federal defenders and the broader security community.
A pull request was opened to add a Nuclei template for CVE-2026-33017. Review comments pushed the template from passive version checks toward an actual POST-based proof-of-concept detection method, and the author updated it accordingly.
Belgium's Centre for Cybersecurity published an advisory warning about the critical Langflow vulnerability and urging immediate patching. This reflected growing government concern over the flaw's risk to AI pipeline deployments.
Multiple references state the vulnerability was fixed in Langflow version 1.9.0, with earlier development builds also addressing it. The remediation removed the unsafe attacker-controlled path in the public flow build process.
Sysdig released a report detailing how attackers compromised Langflow AI pipelines in about 20 hours. The company described six source IPs, staged payload delivery, credential theft, and use of custom tooling and shared infrastructure.
Sysdig observed exploitation attempts roughly 20 hours after disclosure, showing attackers weaponized the flaw without a public proof-of-concept. Activity included scanning, RCE validation, reconnaissance, payload delivery, and credential harvesting.
Sysdig detected exploitation attempts against honeypots on March 18, indicating active abuse of the Langflow flaw shortly after disclosure. The observed attacks targeted secrets, credentials, and files tied to AI pipelines.
CVE-2026-33017 was publicly disclosed for Langflow's public flow build endpoint, with reports stating disclosure occurred on March 17, 2026. GitHub also assigned the CVE on that date according to later reporting.
Langflow published GitHub advisory GHSA-vwmf-pq79-vjvx describing a critical unauthenticated remote code execution flaw in the public flow build endpoint. The advisory explained that attacker-supplied flow data could reach an unsandboxed exec() path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcedarkwebinformer.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecvefeed.io
Open sourcewebflow.sysdig.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **Langflow** vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active attacks, ordering U.S. federal agencies to remediate **`CVE-2026-55255`** by **July 10**. The flaw is an insecure direct object reference in **`/api/v1/responses`** that lets an authenticated attacker use a victim flow UUID to access another user's flow, exposing sensitive data and consuming the victim's resources. Reporting also tied Langflow to broader KEV updates, including **`CVE-2025-3248`**, a missing-authentication flaw in **`/api/v1/validate/code`** that allows unauthenticated remote code execution and was updated in CISA's catalog to show **known ransomware use**. Sysdig said it observed in-the-wild exploitation of **`CVE-2026-55255`** on June 25, alongside repeated abuse of **`CVE-2026-33017`**, an unauthenticated Langflow RCE that attackers appeared to prefer because it is easier to operationalize and provides direct host compromise. The observed operator enumerated flows through **`/api/v1/flows/`**, then abused **`POST /api/v1/responses`** with prompts such as "leak api keys" to trigger another tenant's flow and attempt credential theft, while also deploying a malicious Langflow component that fetched a second-stage shell script from **`45.207.216.55:8084`**. Researchers assessed the activity as automated, opportunistic, and financially motivated, combining credential theft, compute abuse, implant delivery, and botnet-style monetization.
Jul 9, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026