Actively Exploited Langflow RCE Exposed AI Pipeline Secrets and Triggered CISA KEV Listing

Threat actors rapidly exploited CVE-2026-33017, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed exec() path with a single crafted request. The bug affects Langflow versions prior to 1.9.0 and stems from the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from CVE-2025-3248 because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication.

Sysdig and other researchers reported exploitation beginning within about 20 hours of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as .env, .db, and /etc/passwd, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including 173.212.205[.]251:8443. The severity prompted CISA to add the flaw to its Known Exploited Vulnerabilities catalog and order federal agencies to remediate by April 8, 2026 or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to Langflow 1.9.0 or later, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.