CVE-2026-33017 - Vulnerability Analysis

BeyondMachines :verified:

@beyondmachines1

Mar 21, 2026

Critical Langflow RCE Vulnerability CVE-2026-33017 Exploited Within Hours Researchers report active exploitation of a critical RCE vulnerability (CVE-2026-33017) in Langflow that allows unauthenticated attackers to execute arbitrary Python code and steal sensitive API keys. The flaw was weaponized within 20 hours of disclosure, targeting exposed AI orchestration pipelines to harvest credentials and environment variables. **If you're running Langflow, this is urgent. Update immediately to version 1.9.0.dev8 or later to patch CVE-2026-33017, and disable the AUTO_LOGIN=true default setting. Until you can update, restrict network access to the vulnerable endpoint, place Langflow behind a reverse proxy with authentication. Regardless if you patch or isolate, make sure to rotate all API keys and credentials the platform uses after isolating.** #cybersecurity #infosec #attack #activeexploit https://beyondmachines.net/event_details/critical-langflow-rce-vulnerability-cve-2026-33017-exploited-within-hours-q-n-c-a-6/gD2P6Ple2L

BeyondMachines :verified:

@beyondmachines1

Mar 21, 2026

Critical Langflow RCE Vulnerability CVE-2026-33017 Exploited Within Hours Researchers report active exploitation of a critical RCE vulnerability (CVE-2026-33017) in Langflow that allows unauthenticated attackers to execute arbitrary Python code and steal sensitive API keys. The flaw was weaponized within 20 hours of disclosure, targeting exposed AI orchestration pipelines to harvest credentials and environment variables. **If you're running Langflow, this is urgent. Update immediately to version 1.9.0.dev8 or later to patch CVE-2026-33017, and disable the AUTO_LOGIN=true default setting. Until you can update, restrict network access to the vulnerable endpoint, place Langflow behind a reverse proxy with authentication. Regardless if you patch or isolate, make sure to rotate all API keys and credentials the platform uses after isolating.** #cybersecurity #infosec #attack #activeexploit https://beyondmachines.net/event_details/critical-langflow-rce-vulnerability-cve-2026-33017-exploited-within-hours-q-n-c-a-6/gD2P6Ple2L

HackerWorkspace

@hackerworkspace

Mar 20, 2026

Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html Short summary: https://hackerworkspace.com/article/critical-langflow-flaw-cve-2026-33017-triggers-attacks-within-20-hours-of-disclosure #cybersecurity #threatintelligence #vulnerability

AA

@AAKL

Mar 20, 2026

From yesterday. Langflow is "an open-source visual framework for building AI agents and retrieval-augmented generation (RAG) pipelines." Sysdig: CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours More: Infosecurity-Magazine: https://www.infosecurity-magazine.com/news/hackers-exploit-critical-langflow/ #infosec