criticalSecurity flaw UnknownPublish anonymously
Langflow Unauthenticated RCE (CVE-2026-33017)
by Publish anonymously · 2 days agoviews 0en
PII protected
Personal information such as emails, phone numbers, IDs and access tokens are automatically masked before publication.
Follow-up code injection (CVSS 9.3) to CVE-2025-3248; added to CISA KEV catalog. Exploitation began within 20 hours of advisory publication; .env and .db harvesting within 24 hours. Previously, CVE-2025-3248 exec()'d user-submitted Python without authentication, actively exploited to deploy the Flodric botnet.