The Cybersecurity and Infrastructure Security Agency (CISA) is alerting users about ongoing exploitation of a serious weakness, CVE-2026-33017, affecting the Langflow framework used to create AI agents.

This security vulnerability has a severity score of 9.3 out of 10, enabling remote code execution and allowing unauthorized individuals to create public workflows.

The agency added the vulnerability to its Known Exploited Vulnerabilities catalog, classifying it as a code injection issue.

Researchers at Sysdig, a cybersecurity firm, report that exploitation of CVE-2026-33017 began roughly 20 hours after the vulnerability’s details were released on March 19.

At that time, no publicly available exploit code existed, but Endor Labs suggests that attackers developed exploits directly from the vulnerability’s published information.

Automated scanning started within 20 hours, followed by exploitation using Python scripts within 21 hours, and the theft of data files (.env and .db) within 24 hours.

Langflow is a widely used open-source tool for visually constructing AI workflows, boasting 145,000 stars on GitHub. It offers a drag-and-drop interface for creating executable pipelines and a REST API for programmatic execution.

Due to its popularity within the AI development community, the tool has become a profitable target for hackers.

In May 2025, CISA previously warned about active exploitation in Langflow, specifically targeting CVE-2025-3248, a critical API issue enabling remote code execution without authentication, potentially leading to complete server compromise.

The latest vulnerability, CVE-2026-33017, allows attackers to run arbitrary Python code and affects Langflow versions 1.8.1 and earlier, potentially exploitable through a specially crafted HTTP request due to unsecured workflow execution.

While CISA did not associate this flaw with ransomware attacks, federal agencies were given until April 8 to apply security updates or mitigations or discontinue using the product.

System administrators should upgrade to Langflow version 1.9.0 or later, which resolves the security issue, or disable/restrict the vulnerable endpoint.

Sysdig also advises against directly exposing Langflow to the internet, monitoring outbound network traffic, and rotating API keys, database credentials, and cloud secrets upon detecting suspicious activity.

CISA’s deadline is officially applicable to organizations subject to Binding Operational Directive (BOD) 22-01, but private businesses, state and local governments, and other non-federal entities are also encouraged to treat it as a guideline and take comparable action.