CVE-2026-33017

# CVE-2026-33017: Langflow Unauthenticated Code Injection **What it is:** Langflow allows attackers to inject and execute arbitrary code when building public flows without authentication credentials. **Impact:** An unauthenticated attacker can execute code within the Langflow environment, potentially compromising the underlying system, accessing sensitive data, or pivoting to connected infrastructure. **Required actions:** - Identify all Langflow instances in your environment and their exposure (internal vs. public-facing). - Apply patches from Langflow immediately when available. - Restrict network access to Langflow deployment ports until patched. - Review logs for suspicious flow creation or execution activity. - Audit any flows created during the vulnerability window for malicious modifications.