+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: CVE-2026-33017: Unauthenticated RCE in Langflows Public Flow Endpoint Explained (/showthread.php?tid=6322767)
CVE-2026-33017: Unauthenticated RCE in Langflows Public Flow Endpoint Explained - Stanley - Mar 26, 2026
CVE-2026-33017: Unauthenticated RCE in Langflow’s Public Flow Endpoint Explained
Langflow fixed an unauthenticated RCE (CVE-2025-3248) by adding auth to /api/v1/validate/code. But the public flow build endpoint (/api/v1/build_public_tmp) accepts the same attacker-controlled code through a different path and feeds it to the same unsandboxed exec(). One curl request, no credentials, full server compromise. CVSS 9.3 Critical. Update immediately.
https://hackernoon.com/cve-2026-33017-unauthenticated-rce-in-langflows-public-flow-endpoint-explained?source=rss