CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template

Nuclei template that detects CVE-2026-33017 — an unauthenticated remote-code-execution vulnerability in Langflow ≤ 1.8.2 reachable through the public flow-build endpoint:

POST /api/v1/build_public_tmp/{flow_id}/flow

The vulnerable handler accepts an attacker-controlled data flow graph and passes data.nodes[].data.node.template.code.value straight into Python exec() during graph build, with no sandboxing. The fix (≥ 1.9.0) drops the data parameter from the handler signature, so a patched build rejects the same request at FastAPI's validation layer with HTTP 422.

How the template decides

The template is non-destructive. It sends an inert payload against a zero-UUID flow ID, so it cannot reach exec() even on a vulnerable host. It distinguishes the vulnerable handler from the patched one by the HTTP response signature alone.

Routing for stage 2:

A real RCE confirmation still requires (a) a real PUBLIC flow UUID on the target and (b) an out-of-band callback (DNS/HTTP). That step is not included here on purpose — this template is the safe pre-check that decides whether running an active exploit makes sense at all.

Usage

Single host:

nuclei -t CVE-2026-33017.yaml -u https://target.example.com

Bulk scan from a list:

nuclei -t CVE-2026-33017.yaml -l targets.txt -rl 20 -c 10

With debug output (see the raw requests/responses):

nuclei -t CVE-2026-33017.yaml -u https://target.example.com -debug-req -debug-resp

Validate the template locally before running it:

nuclei -validate -t CVE-2026-33017.yaml

Example output

Vulnerable target:

[CVE-2026-33017] [http] [critical] https://target.example.com [vulnerable-flow-not-found] ["1.8.2","base"]

Patched target — no finding emitted (422 response does not match any rule).

Finding candidates

Common discovery queries for Langflow hosts (use only against assets you are authorized to test):

• Shodan: http.title:"Langflow"
• FOFA: app="Langflow"
• Google: intitle:"Langflow" inurl:"/flows"

Vulnerability details

• CVE: CVE-2026-33017
• CWE: CWE-94 (Improper Control of Generation of Code)
• CVSS 3.1: 9.3 — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected: Langflow ≤ 1.8.2
• Fixed in: Langflow ≥ 1.9.0
• Vector: Network, unauthenticated, no user interaction
• Impact: Remote code execution as the Langflow process user

Root cause (short)

In vulnerable builds the public handler is declared roughly as:

@router.post("/build_public_tmp/{flow_id}/flow")
async def build_public_flow(flow_id: UUID, data: FlowDataRequest | None = None, ...):
    ...
    await verify_public_flow_and_get_user(flow_id, ...)
    ...
    # data.nodes[].data.node.template.code.value reaches exec() in the
    # Component build path

data is attacker-controlled. The patched handler removes the parameter entirely and forces data=None, which is why a request that includes a data body field is rejected with 422 on patched builds.

Remediation

1. Upgrade Langflow to ≥ 1.9.0.
2. If you cannot upgrade immediately, block /api/v1/build_public_tmp/ at the reverse proxy.
3. Set LANGFLOW_AUTO_LOGIN=False, configure superuser credentials, and rotate LANGFLOW_SECRET_KEY.
4. Audit existing flows — access_type=PUBLIC flows are the ones an attacker would target in the URL.

References

• GitHub Advisory: https://github.com/advisories/GHSA-vwmf-pq79-vjvx
• SonicWall write-up: https://www.sonicwall.com/pt-br/blog/langflow-ai-code-injection-to-rce-flaw
• Patched handler source: https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/api/v1/chat.py

Legal & disclosure

This template is published for defensive security and authorized testing only. Running it against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates platform terms of service.

By using this template you agree that:

• You will only scan assets you own or are explicitly authorized to test (bug-bounty scope, signed pentest engagement, internal asset inventory).
• The author is not responsible for misuse.
• The template is provided as-is, without warranty.

Author

lopseg — https://github.com/lopseg

Pull requests and issues welcome.

License

MIT