CVE-2026-33309 — CRITICAL (CVSS 9.9) AI Security Vulnerability

Q: Is CVE-2026-33309 actively exploited?

No confirmed active exploitation of CVE-2026-33309 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-33309?

1. PATCH: Upgrade Langflow to version 1.9.0 immediately — this is the only complete fix. 2. WORKAROUND (if patching is delayed): Block or rate-limit POST /api/v2/files/ at the WAF/reverse proxy layer; require additional authentication for file upload operations. 3. AUDIT: Review all user accounts with access to the Langflow instance; revoke unnecessary low-privilege accounts. 4. DETECT: Monitor for unexpected file creation events outside Langflow's designated storage directory (e.g., writes to /etc/, /home/, Python site-packages, or cron directories); alert on new processes spawned by the Langflow service user. 5. ISOLATE: Run Langflow in a minimal container with read-only filesystem mounts where possible; restrict the service account to least-privilege OS permissions. 6. VERIFY: Scan your Langflow deployment logs for POST /api/v2/files/ requests with filenames containing '../', '%2e', encoded slashes, or absolute paths.

Q: What systems are affected by CVE-2026-33309?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, AI workflow automation, model serving.

Q: What is the CVSS score for CVE-2026-33309?

CVE-2026-33309 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.05%.

CISO Take

CVE-2026-33309 is a critical RCE in Langflow (CVSS 9.9) that bypasses the previously-issued patch for CVE-2025-68478. Any authenticated user — including trial accounts — can write arbitrary files to the host via a crafted multipart upload, leading to full system compromise. Upgrade to Langflow 1.9.0 immediately; if patching is not possible today, restrict access to the file upload endpoint and audit all authenticated accounts.

Risk Assessment

CRITICAL. CVSS 9.9 with network-reachable attack vector, low complexity, and only low privilege required — meaning any authenticated user is a potential attacker. The Changed scope indicator signals cross-boundary impact: a compromise of the Langflow process can pivot to the underlying host, adjacent containers, or connected AI infrastructure. The fact that this is a patch bypass (not a novel discovery) raises the threat level further: defenders who believed they were protected by the CVE-2025-68478 fix are still exposed. Langflow is widely deployed in enterprise AI pipelines, RAG systems, and agent orchestration environments, significantly broadening blast radius.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
langflow	pip	>= 1.2.0, <= 1.8.1	`1.9.0`
147.9K Pushed today 31% patched ~53d to patch Full package profile →

Do you use langflow? You're affected.

Severity & Risk

CVSS 3.1

9.9 / 10

EPSS

0.0%

chance of exploitation in 30 days

Higher than 14% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

Recommended Action

6 steps

PATCH

Upgrade Langflow to version 1.9.0 immediately — this is the only complete fix.
WORKAROUND (if patching is delayed): Block or rate-limit POST /api/v2/files/ at the WAF/reverse proxy layer; require additional authentication for file upload operations.
AUDIT

Review all user accounts with access to the Langflow instance; revoke unnecessary low-privilege accounts.
DETECT

Monitor for unexpected file creation events outside Langflow's designated storage directory (e.g., writes to /etc/, /home/, Python site-packages, or cron directories); alert on new processes spawned by the Langflow service user.
ISOLATE

Run Langflow in a minimal container with read-only filesystem mounts where possible; restrict the service account to least-privilege OS permissions.
VERIFY

Scan your Langflow deployment logs for POST /api/v2/files/ requests with filenames containing '../', '%2e', encoded slashes, or absolute paths.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Auth Bypass Supply Chain Framework Agent Plugin AML.T0010.001 - AI Software AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration AML.T0105 - Escape to Host

Compliance Impact

This CVE is relevant to:

EU AI Act

Art.15 - Accuracy, Robustness and Cybersecurity Art.9 - Risk Management System

ISO 42001

A.6.1.2 - Information Security in AI System Development and Operation A.9.1 - AI System Risk Treatment

NIST AI RMF

GOVERN-1.7 - Processes and procedures are in place for decommissioning AI systems MANAGE-2.2 - Mechanisms to sustain AI risk management are planned

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities LLM07 - Insecure Plugin Design LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-33309?

CVE-2026-33309 is a critical RCE in Langflow (CVSS 9.9) that bypasses the previously-issued patch for CVE-2025-68478. Any authenticated user — including trial accounts — can write arbitrary files to the host via a crafted multipart upload, leading to full system compromise. Upgrade to Langflow 1.9.0 immediately; if patching is not possible today, restrict access to the file upload endpoint and audit all authenticated accounts.

Is CVE-2026-33309 actively exploited?

No confirmed active exploitation of CVE-2026-33309 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-33309?

1. PATCH: Upgrade Langflow to version 1.9.0 immediately — this is the only complete fix. 2. WORKAROUND (if patching is delayed): Block or rate-limit POST /api/v2/files/ at the WAF/reverse proxy layer; require additional authentication for file upload operations. 3. AUDIT: Review all user accounts with access to the Langflow instance; revoke unnecessary low-privilege accounts. 4. DETECT: Monitor for unexpected file creation events outside Langflow's designated storage directory (e.g., writes to /etc/, /home/, Python site-packages, or cron directories); alert on new processes spawned by the Langflow service user. 5. ISOLATE: Run Langflow in a minimal container with read-only filesystem mounts where possible; restrict the service account to least-privilege OS permissions. 6. VERIFY: Scan your Langflow deployment logs for POST /api/v2/files/ requests with filenames containing '../', '%2e', encoded slashes, or absolute paths.

What systems are affected by CVE-2026-33309?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, AI workflow automation, model serving.

What is the CVSS score for CVE-2026-33309?

CVE-2026-33309 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.05%.

Technical Details

NVD Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.

Exploitation Scenario

An attacker with a low-privilege Langflow account (e.g., a compromised trial user or an insider threat) crafts a multipart HTTP POST to /api/v2/files/ with a filename such as '../../usr/lib/python3/dist-packages/langflow/malicious.py' or a path targeting a cron directory. The HTTP-layer ValidatedFileName check is bypassed because the underlying LocalStorageService performs no boundary containment — the filename passes through the storage layer unchanged. The server writes attacker-controlled Python code to the target path. On next Langflow process restart or scheduled execution, the injected module is imported and the attacker's payload executes with Langflow's process privileges. From there, the attacker establishes a reverse shell, exfiltrates API keys and LLM credentials stored in Langflow's configuration, poisons agent tool definitions to affect downstream AI pipeline consumers, and potentially pivots to connected databases or cloud infrastructure.