Langflow AI Pipeline RCE Exploited Within 20 Hours to Steal Keys and Credentials

By Lucas Martin | June 25, 2026

A critical unauthenticated remote code execution (RCE) vulnerability has been disclosed in Langflow, the widely used open-source visual framework for building AI agents and Retrieval-Augmented Generation (RAG) pipelines.

Tracked as CVE-2026-33017, the flaw allows attackers to execute arbitrary Python code on any exposed Langflow instance using a single HTTP request, with no credentials required.

The vulnerability resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to allow unauthenticated users to build public flows.

The endpoint accepts attacker-supplied flow data containing arbitrary Python code in node definitions, which is then executed server-side without any sandboxing.

This is distinct from CVE-2025-3248, an earlier Langflow RCE added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in May 2025. Despite confirmed active exploitation, CVE-2026-33017 has not yet been added to CISA’s Known Exploited Vulnerabilities catalog.

Langflow boasts over 145,000 GitHub stars and is widely deployed by data science and AI engineering teams to build visual AI agent workflows and RAG pipelines.

The Sysdig Threat Research Team (TRT) deployed honeypot Langflow nodes across multiple cloud regions immediately after the advisory was published.

The first exploitation attempt arrived at 16:04 UTC on March 18, roughly 20 hours after disclosure, with zero public PoC code in existence. Over 48 hours, Sysdig TRT recorded exploitation from six unique source IPs across three distinct attack phases.

Early automated scans used privately authored Nuclei templates. A second attacker class followed with custom Python scripts, performing active reconnaissance through directory listings and credential file reads targeting /etc/passwd and .env.

The most advanced activity came in hours 24–30, when one attacker dumped full environment variables, enumerated the filesystem for .db and .env files, and extracted application secrets containing database credentials, cloud API keys, and service tokens.

Two attacker IPs shared the same C2 server at 143.110.183.86:8080, pointing to a single operator working through multiple proxies with a prepared toolkit.

The 20-hour exploitation window reflects a dangerous industry-wide reality. The median organizational patch time is approximately 20 days, leaving a critical gap that threat actors are actively exploiting.

Defenders should immediately restrict or authenticate access to the /build_public_tmp endpoint, apply the available Langflow patch, and rotate all API keys and cloud credentials stored in environment variables.

Runtime detection tools such as Falco can flag the exploitation behavior — shell spawning from web processes, sensitive file reads, and outbound C2 connections — without requiring CVE-specific signatures.