All CVE records
CVE-2026-33017 — Langflow Code Injection Vulnerability
CISA KEV listed
Added March 25, 2026 Remediate by April 8, 2026
Description
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017
Need help remediating this vulnerability?
Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.