CVE-2026-33017 is a code injection vulnerability in Langflow Langflow. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 March 2026, which means attackers have used it in real attacks. Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
How this vulnerability works
CVE-2026-33017 is a code injection flaw in Langflow, which matters because code injection turns application input into execution. In a workflow builder or flow-management product, that can cross the boundary from ordinary configuration into arbitrary server-side action if the unsafe path is reachable.
The primary danger is not the injection syntax itself, but what it lets an attacker do inside a system that may already hold secrets, integrations, and downstream tool access. Publicly reachable flow creation without authentication increases the chance that untrusted users can reach the vulnerable code path at all.
Why it is dangerous in this kind of product
Products like Langflow often sit close to credentials, connectors, model endpoints, and automation logic. When code injection exists in that environment, the attacker may be able to pivot from a single request into broader compromise of the application runtime, stored configuration, or connected services.
That is why unauthenticated exposure is especially serious here: it removes an important trust boundary before the vulnerable feature is even used. In practice, defenders should treat this as more than a simple web bug, because the impact can extend into secret exposure, service abuse, and follow-on compromise of linked systems. The NIST National Vulnerability Database and the CVE Program remain the authoritative places to confirm the record and its current status.
How organisations should assess exposure and reduce blast radius
Exposure checks should start with asset inventory and internet-facing discovery, because any public deployment is easier to target than an internal one. Teams should verify where Langflow is deployed, whether the vulnerable function is reachable externally, and whether the deployment is isolated from production secrets, internal APIs, and sensitive service accounts.
When patching is delayed, the most useful compensating controls are to remove public reachability, restrict access to trusted networks, place the service behind strong authentication, and reduce the privileges of any account or integration the platform can reach. For a broader view of prioritisation, the Vulnerability Management Guide is a useful reference point for asset scope, KEV-driven prioritisation, and remediation validation.
Detection and post-incident review
Detection should look for unexpected flow creation, abnormal request patterns, suspicious server-side execution, and any signs that the process launched commands, touched files, or contacted external endpoints it normally would not use. If exploitation is suspected, review logs, runtime history, environment variables, connected credentials, and any tokens or secrets the platform could access.
After patching, organisations should still assume the system may have been abused before the fix. A post-patch review should confirm whether any credentials, API keys, session material, or connected service accounts need rotation, because code injection often turns an application flaw into an identity and secret compromise problem.
Risk and Threat Considerations
This vulnerability creates a direct exploitation path from unauthenticated access to code execution conditions, which makes it attractive for opportunistic attackers and for more targeted intrusion chains. The main risk is not only compromise of the Langflow instance itself, but also whatever secrets, integrations, or downstream systems the instance can reach.
Failure mechanism: An attacker reaches the code injection path, executes unintended server-side logic, and uses the application’s trust and privileges to pivot into data, credentials, or adjacent infrastructure.
Impact: This can lead to unauthorized access, secret theft, service abuse, environment tampering, or broader compromise of connected workloads and automation paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Unauthenticated public flow creation is an access-control failure. |
| AC-6 — Least Privilege | Code injection risk worsens when the service can reach high-value assets. | |
| SI-10 — Information Input Validation | Code injection is fundamentally a failure to safely validate untrusted input. | |
| Recommendation — Require authenticated access before users can create or publish flows. Constrain the application to the minimum permissions needed for runtime operation. Validate and constrain all user-controlled inputs before they reach execution paths. | ||
| OWASP ASVS | V2 — Validation and Business Logic | The flaw reflects unsafe handling of input that becomes executable behavior. |
| V4 — API and Web Service | Publicly reachable flow creation is an API-exposed attack surface. | |
| Recommendation — Test flow creation and execution paths for injection-prone input handling. Verify that exposed endpoints enforce authentication, authorization, and safe request handling. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a containment problem as much as a patching problem. If the service is public, lightly authenticated, or allowed to reach valuable secrets, the blast radius can be much larger than the application team expects.
What to watch for: Look for any evidence that the instance can create public flows without authentication, especially if that capability is exposed beyond a trusted admin boundary. If that is true, assume exposure is real until proven otherwise.
Practitioner takeaway: Prioritise exposure reduction, then patch, then rotate any secrets the compromised runtime could have seen or used.