Critical Langflow Flaw Draws Attackers Within 20 Hours of Disclosure as AI Pipeline Security Gaps Widen
CVE-2026-33017, a CVSS 9.3 unauthenticated RCE in the open-source AI framework Langflow, was weaponized within 20 hours of its March 17 advisory with no public exploit code available.
Overview
A critical unauthenticated remote code execution vulnerability in Langflow, the open-source visual framework for building AI agents and retrieval-augmented generation pipelines, was exploited in the wild within 20 hours of its public disclosure on March 17, 2026. The flaw, tracked as CVE-2026-33017 with a CVSS score of 9.3, allows attackers to execute arbitrary Python code on exposed instances with a single HTTP request and no credentials, according to The Hacker News.
The speed of exploitation underscores a broader trend in which threat actors are weaponizing disclosed vulnerabilities faster than most organizations can patch them, a dynamic that carries particular risk for AI and machine learning tooling often deployed outside standard security review processes.
What We Know
The vulnerability resides in Langflow’s /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows building public flows without authentication. When an optional data parameter is supplied, the endpoint uses attacker-controlled flow data containing arbitrary Python code instead of stored database values, passing it directly to Python’s exec() function with no sandboxing, as detailed by The Hacker News.
Security researcher Aviral Srivastava, who discovered and reported the flaw on February 26, 2026, characterized exploitation as “extremely easy,” noting that a single HTTP POST request with malicious Python code embedded in a JSON payload is sufficient for immediate code execution, according to The Hacker News.
All Langflow versions up to and including 1.8.1 are affected. The fix is available in version 1.9.0.
Rapid Weaponization
Cloud security firm Sysdig observed the first exploitation attempt at 16:04 UTC on March 18, approximately 20 hours after the advisory was published, with no public proof-of-concept code available at the time. Attackers built working exploits directly from the advisory description, as reported by The Hacker News.
The attacks unfolded in three distinct phases. Initial automated scanning used nuclei-based vulnerability templates deployed from four IP addresses, executing basic system commands and exfiltrating results via base64 encoding to interactsh callback servers. Within hours, more sophisticated operators transitioned to custom Python scripts conducting reconnaissance, directory listing, and credential file access. By 30 hours after disclosure, the most advanced attackers were executing environment variable dumps, filesystem enumeration for configuration files, and targeted extraction of .env contents containing database credentials and API keys, according to The Hacker News.
Sysdig identified six unique source IP addresses and two command-and-control servers involved in the campaign, with evidence suggesting at least some of the infrastructure was pre-positioned before disclosure.
Scale of Exposure
Langflow has accumulated over 145,000 GitHub stars, indicating substantial adoption across organizations. The framework is particularly popular among data science and AI teams building agent workflows and RAG pipelines, a deployment pattern that often bypasses standard enterprise security review, according to Infosecurity Magazine.
The stolen data, including API keys for services such as OpenAI, Anthropic, and AWS, along with database credentials and cloud access tokens, provides attackers with access to connected databases and potential software supply chain compromise, as reported by Infosecurity Magazine.
What We Don’t Know
The full extent of compromised Langflow instances remains unclear. While the platform’s GitHub popularity suggests widespread use, the number of internet-exposed deployments vulnerable to CVE-2026-33017 has not been publicly quantified. It is also unknown whether the stolen credentials have been used to conduct downstream supply chain attacks against organizations whose API keys and cloud tokens were exfiltrated.
The identity and affiliation of the threat actors behind the campaign have not been disclosed. The coordinated nature of the attacks and evidence of pre-positioned infrastructure suggest organized operators, but attribution remains uncertain.
Analysis
The Langflow incident illustrates a widening gap between the pace of vulnerability exploitation and organizational patch cycles. Industry data cited by Sysdig shows that median time-to-exploit has collapsed from 771 days in 2018 to mere hours by 2024, with 44 percent of exploited vulnerabilities weaponized within 24 hours of disclosure by 2023, as reported by The Hacker News. Organizations relying on multi-week patch cycles now face adversaries operating on sub-day timelines.
The vulnerability also highlights a specific risk category: AI and ML developer tooling deployed with insufficient security controls. Frameworks like Langflow are designed for rapid prototyping and often run with broad permissions to interact with external APIs and databases. When these tools are exposed to the internet without authentication layers, a single vulnerability can cascade into credential theft across multiple connected services.
Langflow users are advised to update to version 1.9.0 immediately, audit environment variables and secrets on any previously exposed instances, rotate all API keys and database passwords, and restrict network access through authenticated reverse proxies.