CRITICALCVSS 9.8Actively exploited · CISA KEV since 2026-03-25Vulnerability

CVE-2026-33017

Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.

Properties

Vulnerability name
Langflow Code Injection Vulnerability
Epss score
0.24755
Last seen
2026-10-19T12:00:27+00:00
Due date
2026-04-08
Exploited euvd since
2026-03-25T00:00:00+00:00
Date added
2026-03-25
Source url
https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
Ghsa updated
2026-03-26T15:41:23Z
Euvd base score version
4.0
Score
9.8
Euvd vendor
langflow-ai
In Signal since
initial import (Sep 2026)
Euvd base score
9.3
Is ghsa only
false
Vendor project
Langflow
Content hash
095cbc01748eeb1202cb08dfa2067b7ae12b22df55eb2d35171c6fed31e54edf
Published at
2026-03-20T05:16:15.550
Euvd updated
2026-05-21T19:54:41+00:00
Last modified
2026-06-17T10:36:47.177
Euvd epss pct
24.76

Related Entities (13)

MENTIONED_IN (6)

→[Campaign]March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Day
→[Campaign]RAT Abuses TON Blockchain to Target Japan's Hotel Industry
→[Campaign]Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited
→[Campaign]How attackers are jailbreaking LLMs with CTF framing and how to catch them
→[Campaign]Unnamed campaign (ID 69bd…)
→[Campaign]CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hours

HAS_WEAKNESS (3)

→[Weakness]Missing Authentication for Critical Function
→[Weakness]Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
→[Weakness]Improper Control of Generation of Code ('Code Injection')

AFFECTS (1)

→[Software]pip/langflow

AFFECTS_PRODUCT (1)

→[Product]cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

DESCRIBES (1)

←[KEVEntry]Langflow Code Injection Vulnerability

INVOLVES (1)

←[Signal]kev_added · 2026-03-25

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-33017 (CVSS 9.8) — Ninja Signal Threat Intelligence | Ninja Signal