ALPARAITrust Infrastructure

Where the world holds AI accountable.

Platform

Incidents
Leaderboard
Dilemmas
Submit Report
Transparency
AI Act Tracker
Challenges

Company

About
Advisory Board
Pricing
Security
Academy
Press Kit

Resources

Blog
Methodology
GitHub
API Docs

Legal

Privacy Policy
Terms of Service
Cookie Policy
DMCA Policy
Moderation Policy

Contact

hello@alparai.com
academy@alparai.com

Intermediary platform. User-submitted content.

Feed Incidents Leaderboard About

Langflow Unauthenticated RCE (CVE-2026-33017) · ALPAR AI

criticalSecurity flaw UnknownAIID ImportPublish anonymously

Langflow Unauthenticated RCE (CVE-2026-33017)

by Publish anonymously · Jun 25, 2026views 3en

PII protected

Personal information such as emails, phone numbers, IDs and access tokens are automatically masked before publication.

Experienced a Similar AI Failure?

Protect the community by reporting a new incident to the ALPAR AI accountability platform.

Report an Incident

Public Verification & Provenance TrailTruthScore: 92.4 / 100

Multi-Model Consensus Audit

3 LLMs verified consensus on Unknown incident

Verification Timeline

Recorded & verified on Mar 1, 2026

Primary Source Linkhttps://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/

This record is cryptographically indexed and accessible to regulators, researchers, and AI audit platforms under the AGPL-3.0 open registry standards.

Follow-up code injection (CVSS 9.3) to CVE-2025-3248; added to CISA KEV catalog. Exploitation began within 20 hours of advisory publication; .env and .db harvesting within 24 hours. Previously, CVE-2025-3248 exec()'d user-submitted Python without authentication, actively exploited to deploy the Flodric botnet.

External Source Attribution

This incident was imported from an external open database. Licensed under CC BY 4.0 or public domain. Original source details below.

Source: AI Incident Database (Open/Stanford License)

Awaiting official response

The official response from the AI provider for this incident.

Community Discussion

No comments yet. Start the discussion!

You must sign in to join the discussion.

Details

AI ProviderUnknown

CategorySecurity flaw

When did it happen?Mar 1, 2026

Languageen