GHSA-vwmf-pq79-vjvx: Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

Summary

The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint in Langflow builds public flows without authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data instead of the stored flow, and node definitions containing arbitrary Python code reach exec() in prepare_global_scope (src/lfx/src/lfx/custom/validate.py) with no sandboxing. The source states this is distinct from CVE-2025-3248, which added authentication to /api/v1/validate/code. Preconditions are at least one public flow and its UUID; the source notes that with AUTO_LOGIN=true, the default, these can be met by an unauthenticated attacker.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langflowPyPIReaches an LLM package through dependencies

Coverage

News, research and other items that mention CVE-2026-33017.

• GenAI and Agentic AI Exploit Roundup Q2 2026OWASP GenAI Security · 2026-07-09

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online