CVE-2026-33017: Unauthenticated RCE in Langflow’s Public Flow Endpoint Explained

Langflow fixed an unauthenticated RCE (CVE-2025-3248) by adding auth to /api/v1/validate/code. But the public flow build endpoint (/api/v1/build_public_tmp) accepts the same attacker-controlled code through a different path and feeds it to the same unsandboxed exec(). One curl request, no credentials, full server compromise. CVSS 9.3 Critical. Update immediately.