Cybercriminals exploited a critical RCE flaw in Langflowjust hours after it was disclosed. As a result, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to the List of Known Exploitable Vulnerabilities (KEV). The flaw, which allows code execution on vulnerable Langflow instances without credentials, was weaponized within 20 hours of disclosure .
According to a report by Sysdig, criminals began attacking a fleet of honeypot nodes with vulnerable instances across multiple cloud providers and regions. Sysdig observed four such attempts within a few hours, with one attacker proceeding to extract environment variables.
“The attacks are notable because there was no public POC repository on GitHub at the time of the first attack,” Sysdig researchers said. “The advisory itself contained enough details (the path to the vulnerable endpoint and the mechanism for code injection via flow node definitions) for the attackers to construct a working exploit without further research.”
See also: LangChain – LangGraph: Vulnerabilities expose files and secrets
CISA calls on federal agencies to remediate their systems by April 8, 2026.
Langflow: A default setting allows code injection
The vulnerability, tracked as CVE-2026-33017, stems from an exposed API endpoint in Langflow, the open-source visual framework for building AI agents and Retrieval-Augmented Generation (RAG) pipelines. The exposure allows attackers to submit malicious workflow data containing embedded Python code.
Instead of using trusted data, the application executes this code, provided by the attacker without any isolation, leading to unauthenticated remote code execution on affected systems.
“The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but accepts malformed flow data provided by the attacker that contains arbitrary executable code,” the NVD description added. “This is different from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication.”
See also: CISA warns of critical vulnerability in PTC Windchill
The Code Injection flaw affects Langflow versions up to and including 1.8.2 and has been fixed in version 1.9.0 .
It received a critical CVSS score of 9.3 / 10, due to the “unauthenticated” and simple exploitability, the massive AI attack surface, and the high impact.
The exploitation rate raises concerns
The exploitation activity was observed less than a day after the vulnerability was made public, which, as Sysdig noted, shows that malicious users move quickly when it comes to new vulnerabilities (likely through automation).
See also: Coruna iOS Kit: How does it relate to 2023's Operation Triangulation?
Attackers were able to construct a working exploit from just the advisory description and quickly began scanning for flawed instances. “The extracted information included keys and credentials, which provided access to connected databases and potentially allowed for a breach of the software supply chain,” Sysdig researchers said.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The researchers recommend immediately upgrading to patched versions, limiting exposure , and monitoring for anomalous activity, emphasizing that exposed instances should be treated as potentially compromised.
