Hackers exploit vulnerability of Langflow

In a particularly worrying development in cybersecurity, attackers began exploiting a critical vulnerability in Langflow less than 24 hours after it was made public. According to analysis by security firm Sysdig, the first malicious activity was detected just 20 hours after the technical details were published, highlighting the speed with which threats are evolving in the artificial intelligence ecosystem.

Langflow is a widely used open-source framework for building AI agents and automated workflowsusing a visual builder interface. Its popularity is impressive, with tens of thousands of users and a strong presence in the developer community, making it an attractive target for large-scale attacks.

See also: Langflow vulnerability exploited by Flodrix Botnet

The vulnerability that opened the «backdoor»»

On March 17, Langflow version 1.8.1 was released , which included fixes for a serious security flaw. The vulnerability, documented as CVE-2026-33017 with a high severity rating (CVSS 9.3), allowed unauthorized remote code execution (RCE).

The issue is located in a POST endpoint, which is used to create public flows without requiring authentication. Through an optional parameter, attackers could inject malicious Python code into node definitions, which would execute directly on the system without sandboxing. In other words, a single HTTP request was enough to completely compromise a vulnerable instance.

Interestingly, there was no proof-of-concept exploit available at the time of the first attacks. However, the technical details included in the initial publication were sufficient for attackers to develop working exploits almost immediately.

Langflow vulnerability exploitation: The stages of the attack

Sysdig documented a multi-phased approach to exploiting the vulnerability. In the initial phase, within 48 hours of publication, mass scans from multiple IP addresses, using identical payloads. This indicates the possible use of automated tools to identify vulnerable systems on a large scale.

See also: CISA added Langflow vulnerability to KEV Catalog

Subsequently, more targeted activity, where different infrastructures were used to actively identify and confirm vulnerable targets. At this stage, the attackers reportedly leveraged scripts to deploy more sophisticated payloads.

The third stage involved data extraction, with attacks aimed at obtaining sensitive information. The collected data was sent to a common command-and-control server, suggesting either a single threat actor or the use of a common attack toolkit.

Targeting credentials and the supply chain

The attackers’ primary goal appears to be to steal API keys, credentials, and access data to connected databases. Given the nature of Langflow, which is often connected to multiple AI services and infrastructures, successful exploitation could lead to broader attacks across the software supply chain.

This significantly increases the risk, as a compromised system is not merely an isolated incident, but a potential entry point for attacks on larger application and service ecosystems.

See also: NCSC: Introduces new Vulnerability Research Initiative

Another alarm for the AI ecosystem

This incident highlights a critical reality: AI tools, as powerful as they are, introduce new attack surfaces that are not yet fully mature from a security perspective. The speed with which attackers exploited the Langflow vulnerability shows that the time window for organizations to react is now extremely limited.

For businesses and developers, the message is clear: the immediate application of security updates and continuous monitoring of systems are no longer optional practices, but a fundamental prerequisite for survival in the modern digital environment.