ADVISORY UNAUTH-2026-0041
TYPE cve
PRODUCT Langflow
SEVERITY CRITICAL

CRITICAL

Langflow CVE-2026-33017

published 2026-08-05 · updated 2026-08-05

Why it matters

Unauthenticated RCE: POST /api/v1/build_public_tmp/{flow_id}/flow accepts attacker-controlled flow definitions whose node code is passed to exec() without sandboxing. Actively exploited within ~20h of disclosure. CVSS 9.3.

Affected versions

<1.9.0

Fixed in: 1.9.0

Mapping provenance: human-verified against the linked advisory, last checked 2026-07-29.

Fix it

Fix card: cve-2026-33017 →

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33017

Cite this record

unauth.dev advisory UNAUTH-2026-0041 — published 2026-08 · CC-BY 4.0

Canonical URL: https://unauth.dev/advisories/UNAUTH-2026-0041. This record is part of the unauth.dev advisory dataset, published under CC-BY 4.0: attribute "unauth.dev / Raúl Acedo". Schema: additive-only within v1; this id will never be renumbered or reused.