CVE ID
CVE-2026-33017
Vulnerability Name
Langflow Code Injection Vulnerability
- Project: Langflow
- Product: Langflow
Date
- Date Added: 2026-03-25
- Due Date: 2026-04-08
Description
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017
Related Security News
- Langflow Vulnerability CVE-2026-5027 Exploited for Unauthenticated RCE
- Path traversal flaw in AI dev platform Langflow exploited in attacks
- Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
- CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation
- LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks
- CISA: New Langflow flaw actively exploited to hijack AI workflows
