9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33017

CVE-2026-33017: Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33017

CVE-2026-33017:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langflow	pip	<= 1.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated remote code execution in Langflow. It exists because the /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to be unauthenticated for public flows, incorrectly accepts an optional data parameter. This parameter allows an attacker to supply their own flow definition, which can contain arbitrary Python code. This code is then executed by the server without any sandboxing.

The execution chain starts at the build_public_tmp function in src/backend/base/langflow/api/v1/chat.py. This function takes the attacker-controlled data and passes it to start_flow_build. The data then flows through a series of functions that build a graph from the provided flow definition. Ultimately, the prepare_global_scope function in src/lfx/src/lfx/custom/validate.py is called, which uses exec() to execute the malicious code.

The root cause of the vulnerability is the combination of a lack of authentication on a critical endpoint and the improper handling of user-supplied data, which is treated as trusted code. The recommended fix is to remove the data parameter from the build_public_tmp function, forcing public flows to only use their stored data.

Vulnerable functions

build_public_tmp

src/backend/base/langflow/api/v1/chat.py

This is the main entry point for the vulnerability. It's an unauthenticated API endpoint that accepts a `data` parameter. An attacker can provide a malicious flow definition in the `data` parameter, which is then processed and executed by the server. The lack of authentication allows any unauthenticated user to trigger this vulnerability.

start_flow_build

src/backend/base/langflow/api/v1/chat.py

This function receives the attacker-controlled `data` from the `build_public_tmp` endpoint and passes it down the execution chain to the graph building process. It is a key function in the chain that leads to code execution.

prepare_global_scope

src/lfx/src/lfx/custom/validate.py

This function is the sink of the vulnerability. It takes a compiled code object and executes it using `exec()`. The code being executed is derived from the attacker-controlled `data` parameter from the `build_public_tmp` endpoint. This is where the arbitrary code execution occurs.

create_graph

src/backend/base/langflow/graph/graph/build.py

This function is part of the code execution chain. It is responsible for creating the graph from the flow data. When attacker-supplied data is provided, it calls `build_graph_from_data` which uses the malicious data.

eval_custom_component_code

src/backend/base/langflow/graph/graph/eval.py

This function is part of the code execution chain. It is responsible for evaluating the custom component code provided by the attacker. It calls `create_class` which in turn leads to the execution of the malicious code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.