{"id":"langflow-public-flow-code-execution-mar-2026","category":"patch","status":"closed","title":"Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining","tldr":"Attackers exploited Langflow’s AI workflow builder to run code without logging in, harvest credentials and install cryptocurrency miners. Version 1.8.2 remained vulnerable; 1.9.0 fixes this flaw. Ask your IT team to update and check exposed servers.","summary":"CVE-2026-33017 affects Langflow, a visual tool for building AI agents and workflows. Its public-flow feature accepted supplied code and ran it with the server application’s permissions, allowing remote attackers to access files and credentials without logging in. Langflow’s current advisory lists versions through 1.8.2 as affected and 1.9.0 onwards as fixed. Sysdig observed exploitation on 18 March, including credential harvesting against its decoy servers, and CISA listed the flaw on 25 March. JFrog then confirmed that 1.8.2 was still vulnerable despite earlier claims that it was patched: the effective fix was initially available only in a nightly build. Stable 1.9.0 reached GitHub and PyPI on 14 April. Later reporting described cryptocurrency-mining attacks continuing into April. A software fix is available; the reviewed sources do not establish that exploitation has ended.","action":"If your business or family office runs Langflow, ask its IT team to install the latest stable release; 1.9.0 is the minimum fix for this flaw. Have them check any previously internet-accessible server for compromise and rotate exposed API keys, database passwords and cloud credentials.","product":"Langflow AI workflow builder","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-33017"],"tags":["langflow","ai","code-injection","credential-theft","cryptojacking"],"affected":["Langflow <= 1.8.2"],"fixed":["Langflow >= 1.9.0"],"matches":[],"sources":[{"kind":"advisory","title":"Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx","by":"Langflow","date":"2026-03-16"},{"kind":"research","title":"CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours","url":"https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours","by":"Sysdig","date":"2026-03-19"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — CVE-2026-33017","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"research","title":"Langflow CVE-2026-33017: Latest 'fixed' version is still exploitable","url":"https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/","by":"JFrog","date":"2026-03-26"},{"kind":"post","title":"Langflow 1.9.0 release","url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","by":"Langflow","date":"2026-04-14"},{"kind":"post","title":"langflow 1.9.0 — release files and publication date","url":"https://pypi.org/project/langflow/1.9.0/","by":"PyPI","date":"2026-04-14"},{"kind":"news","title":"Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints","url":"https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html","by":"The Hacker News","date":"2026-06-30"}],"started":"2026-03-16","closed":"2026-06-30","created":"2026-11-03T22:27:00.049Z","updated":"2026-11-03T22:27:00.049Z","cve_notes":[{"cve":"CVE-2026-33017","name":"Unauthenticated code execution in Langflow public flows","what":"Langflow’s public-flow builder accepts attacker-supplied Python code and executes it with the server application’s permissions, allowing attackers to read or change files and steal credentials without logging in.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-06-30","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"The Hacker News reported Trend Micro’s findings of Monero-mining attacks exploiting this flaw between 27 March and 15 April. The malware also attempted to spread to other computers using SSH keys.","url":"https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html","by":"The Hacker News","patch":null},{"at":"2026-04-14","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"Langflow released stable version 1.9.0, the version its advisory identifies as fixing this flaw. The package was also published on PyPI that day.","url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.0","by":"Langflow","patch":"patched"},{"at":"2026-03-26","added":"2026-11-03T22:24:44.025Z","kind":"fix-incomplete","text":"JFrog confirmed that 1.8.2 remained vulnerable in both Python packages and official Docker images, despite earlier fix claims. The fix worked in a nightly build, but stable 1.9.0 was still unreleased.","url":"https://research.jfrog.com/post/langflow-latest-version-was-not-fixed/","by":"JFrog","patch":"partial"},{"at":"2026-03-25","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-33017 to its Known Exploited Vulnerabilities catalogue, with an 8 April remediation deadline for US federal civilian agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-03-18T16:04Z","added":"2026-11-03T22:24:44.025Z","kind":"wider-attacks","text":"Sysdig observed the first exploitation attempt against its decoy servers, followed by credential harvesting later that day. It recorded attacks from six source IP addresses within 48 hours of disclosure.","url":"https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours","by":"Sysdig","patch":null},{"at":"2026-03-16","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Langflow’s advisory disclosed unauthenticated code execution through public flow building. GitHub dates publication to 16 March; Sysdig’s subsequent report gives 17 March.","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx","by":"Langflow","patch":null}],"url":"https://hard.fyi/live/langflow-public-flow-code-execution-mar-2026/","json":"https://hard.fyi/api/live?id=langflow-public-flow-code-execution-mar-2026"}