Skip to content

KEV: Langflow code injection (CVE-2026-33017)

Signal: Added to CISA KEV on 2026-03-25 (due 2026-04-08). Langflow is exploitable in the wild.

What it is

Langflow contains a code injection issue that can allow creation of public flows without authentication, enabling downstream arbitrary code execution paths depending on how flows/tools are configured.

References: - CISA KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - Advisory: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33017

Triage (15 minutes)

  1. Inventory: find any Langflow instances (containers, k8s, PaaS) and whether they are internet-exposed.
  2. Confirm whether the instance allows anonymous/public flow creation or has any unauthenticated endpoints enabled.
  3. Identify what the instance can reach:
  4. Secrets in env vars / mounted volumes
  5. Network access (databases, internal services)
  6. Any “tool” integrations (shell, HTTP, cloud APIs)

Mitigation

  • Patch/upgrade immediately per vendor instructions (see GHSA).
  • If you cannot patch today:
  • Remove public exposure (VPN / allowlist / internal-only ingress).
  • Add a WAF / reverse proxy rule to require auth for all app paths (defense-in-depth; do not rely on it as a fix).
  • Run with least privilege (drop Linux caps, read-only FS where possible, no host mounts).

Hunt / detection

  • Review reverse-proxy/app logs for:
  • Requests from new IPs to flow creation/build endpoints
  • Sudden creation of many flows or flows marked public
  • Look for post-exploitation indicators:
  • Unexpected outbound connections from the Langflow pod/container
  • New processes spawned by the runtime (python/node) that are not part of normal operation

Recovery notes

If compromise is suspected, assume secrets accessible to the service are burned: - Rotate credentials/tokens reachable by the Langflow runtime. - Rebuild from known-good images, redeploy with fresh secrets.