Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.

Researchers have identified exploitation attempts in the wild for this Langflow vulnerability. Apply patches or restrict network access to the build_public_tmp API endpoint.

According to its banner, the version of Langflow running on the remote host is prior to 1.9.0. It is, therefore, affected by a multiples vulnerabilities :

- An Authenticated Code Execution in agentic assistant validation

- An Unauthenticated Remote Code Execution via public flow build endpoint

- A Path Traversal in knowledge bases API via bulk delete endpoint

- An Arbitrary File Write (RCE) through the V2 API

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Langflow versions before 1.8.2 allow unauthenticated remote code execution via the '/api/v1/build_public_tmp/{flow_id}/flow' endpoint. Attacker-supplied flow data with arbitrary Python code in node definitions is passed to exec() without sandboxing, enabling code execution without authentication. This detection is included in the AI and LLM category.

The version of Langflow installed on the remote host is prior to 1.9.0. It is, therefore, affected by a remote code execution vulnerability:

  - The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows     without requiring authentication. When the optional data parameter is supplied, the     endpoint uses attacker-controlled flow data containing arbitrary Python code in node     definitions instead of the stored flow data from the database. This code is passed to     exec() with zero sandboxing, resulting in unauthenticated remote code execution.
    (CVE-2026-33017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0,
    the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring
    authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow
    data (containing arbitrary Python code in node definitions) instead of the stored flow data from the
    database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code
    execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding
    authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but
    incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been
    fixed in version 1.9.0. (CVE-2026-33017)

ID	Name	Product	Family	Type	Severity
115277	Langflow < 1.9.0 Multiples Vulnerabilities	Web App Scanning	Artificial Intelligence	Version Based	critical
115176	Langflow < 1.8.2 Unauthenticated Remote Code Execution	Web App Scanning	Artificial Intelligence	Check Based	critical
303795	Langflow < 1.9.0 RCE (GHSA-vwmf-pq79-vjvx)	Nessus	Artificial Intelligence	Combined	critical
439185	SCA: security update for langflow (GHSA-vwmf-pq79-vjvx)	Tenable Cloud Security	SCA Checks	Local	critical
439185	SCA: security update for langflow (GHSA-vwmf-pq79-vjvx)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-33017

critical

Tenable Plugins

critical

critical

critical

critical

critical