Langflow RCE Exploited in 20 Hours From Advisory Alone: Attackers Are Harvesting Your AI Pipeline Keys

The Story

On March 17, 2026, Langflow published an advisory for CVE-2026-33017, a critical unauthenticated RCE in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint. The endpoint is designed to let unauthenticated users build public flows. The vulnerability exists because when the optional data parameter is supplied, the endpoint accepts attacker-controlled flow data containing arbitrary Python code in node definitions and passes it directly to exec() with zero sandboxing.

Within 20 hours of the advisory going live, Sysdig's Threat Research Team observed the first exploitation attempts in the wild. No public proof-of-concept code existed on GitHub at the time. The attackers read the advisory, understood the vulnerable endpoint path and injection mechanism, and built working exploits from that information alone.

Sysdig deployed honeypot Langflow instances across multiple cloud providers and documented a three-phase attack pattern over 48 hours from six unique source IPs. Phase one (hours 20 to 21): automated nuclei scanning from four IPs sending identical payloads, executing id, base64-encoding the output, and exfiltrating it to an interactsh callback server. These were privately authored nuclei templates, not from the public repository. Phase two (hours 21 to 24): a different attacker using custom Python scripts performed directory listing, credential file access, system fingerprinting, and deployed a stage-2 dropper from pre-staged infrastructure. Phase three (hours 24 to 30): targeted data harvesting, dumping all environment variables (database connection strings, API keys, cloud credentials) and locating configuration files and databases.

The exfiltrated data is the real story. Langflow instances are typically configured with API keys for OpenAI, Anthropic, AWS, and database connections. Compromising one instance gives an attacker lateral access to cloud accounts, data stores, and the AI pipelines themselves. As one researcher noted, the downstream blast radius from poisoned pipelines, compromised tool-calls, and corrupted retrieval stores could far exceed the initial RCE.

This is the second critical unauthenticated RCE in Langflow in under a year. CVE-2025-3248 (CVSS 9.8), disclosed in early 2025, exploited the /api/v1/validate/code endpoint using the exact same unsandboxed exec() call. That flaw was added to CISA's KEV catalog and actively exploited by the Flodrix botnet. The fix for CVE-2025-3248 did not prevent CVE-2026-33017 because the vulnerable endpoint is architecturally designed to be unauthenticated. The researcher who discovered the new flaw noted that adding authentication would break the entire public flows feature. The actual fix required removing the ability for the endpoint to accept external flow data entirely.

Additionally, when Langflow's default AUTO_LOGIN=true setting is active (which it is out of the box), an attacker can call GET /api/v1/auto_login to obtain a superuser token, create their own public flow, and then exploit it. This means even instances without pre-existing public flows can be targeted.

The Adversary Perspective

From an offensive standpoint, CVE-2026-33017 is close to an ideal vulnerability. The exploitation prerequisites are minimal: a single HTTP POST with a JSON payload. No authentication. No multi-step chain. No session management. The target population is large (145,000+ GitHub stars), and many instances are deployed by data science and ML teams who may operate outside the security team's standard patching cadence.

The advisory itself was the exploit documentation. It described the vulnerable endpoint path, the injection mechanism, and the root cause in enough detail for an attacker to construct a working exploit without any reverse engineering or code analysis. This is a pattern we are seeing more frequently: security advisories containing sufficient technical detail to serve as weaponization guides.

The target value is disproportionately high. AI orchestration platforms like Langflow sit at the center of agentic AI workflows, connected to LLM providers, vector databases, cloud infrastructure, and internal data sources. A single compromised Langflow instance can yield API keys for OpenAI and Anthropic (enabling LLM abuse or resale), AWS credentials (enabling cloud pivot), database connection strings (enabling data theft), and the ability to poison AI pipeline outputs that downstream applications rely on.

The structural recurrence is the most concerning aspect. The same unsandboxed exec() pattern produced two critical RCEs on different endpoints. Any security architect reviewing the Langflow codebase after CVE-2025-3248 should have audited every other call site that passes user-controlled data to exec(). The fact that CVE-2026-33017 exists suggests that the original fix was scoped to the specific endpoint rather than the underlying architectural pattern.

Defensive Takeaways