Provenance Record

[{"url":"https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html","status":"verified","findings":"Confirms CVE-2026-33017 with CVSS 9.3. Confirms vulnerable endpoint /api/v1/build_public_tmp/{flow_id}/flow. Confirms exec() with no sandboxing. Confirms Aviral Srivastava reported Feb 26. Confirms Sysdig observed exploitation within 20 hours of March 17 advisory. Confirms three-phase attack progression. Confirms affected versions through 1.8.1, fix in 1.9.0. Confirms time-to-exploit statistics (771 days in 2018 to hours by 2024, 44% within 24 hours by 2023)."},{"url":"https://www.infosecurity-magazine.com/news/hackers-exploit-critical-langflow/","status":"verified","findings":"Confirms CVE-2026-33017 CVSS 9.3 RCE. Confirms attackers harvested database credentials, API keys, cloud credentials. Confirms no authentication required. Note: the article does NOT mention 145,000 GitHub stars — this specific figure may come from Langflow's GitHub page directly rather than from this source."}]

Core claims verified: CVE ID, CVSS score, vulnerable endpoint, exec() exploitation, 20-hour weaponization timeline, Sysdig observations, three attack phases, affected versions. The 145,000 GitHub stars claim is attributed to Infosecurity Magazine but was not found in the accessible article content — this may be sourced from Langflow's GitHub page directly. All other technical details confirmed.

Solid cybersecurity news article with accurate technical reporting. All critical claims about the vulnerability, exploitation timeline, and attack phases are well-sourced. Minor concern about the GitHub stars attribution does not affect the article's core accuracy. Word count (751) appropriate for News category.