{"id":199505,"date":"2026-03-26T17:07:00","date_gmt":"2026-03-26T21:07:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/26\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog\/"},"modified":"2026-03-26T18:00:23","modified_gmt":"2026-03-26T22:00:23","slug":"u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/26\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog\/","title":{"rendered":"U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog"},"content":{"rendered":"<p><a href=\"https:\/\/securityaffairs.com\/190018\/security\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html\">U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog<\/a><\/p>\n<p><a href=\"https:\/\/securityaffairs.com\/190018\/security\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html\">https:\/\/securityaffairs.com\/190018\/security\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-03-26 17:07:00<\/a><\/p>\n<p>Source Domain: <a href=\"securityaffairs.com\">securityaffairs.com<\/a><\/p>\n<p>Author: <a href=\"\"><\/a><\/p>\n<p> Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n<p>\t\t\t\t\t\t\tU.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog<\/p>\n<p>\t\t\t\t\t\t\t Pierluigi Paganini<br \/>\n\t\t\t\t\t\t\t March 26, 2026<\/p>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Langflow to its Known Exploited Vulnerabilities catalog.<\/p>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added\u00a0a Langflow flaw, tracked as CVE-2026-33017 (CVSS score of 9.3), to its\u00a0Known Exploited Vulnerabilities (KEV) catalog.<\/p>\n<p>Langflow\u00a0is a popular tool used for building agentic AI workflows.\u00a0<\/p>\n<p>CVE-2026-33017 is a critical flaw in Langflow (before v1.9.0) that allows attackers to execute arbitrary code without authentication. The public build endpoint accepts user-supplied data containing Python code, which is executed via exec() without sandboxing. This can lead to full system compromise.<\/p>\n<p>\u201cThe\u00a0POST \/api\/v1\/build_public_tmp\/{flow_id}\/flow\u00a0endpoint allows building public flows without requiring authentication. When the optional\u00a0data\u00a0parameter is supplied, the endpoint uses\u00a0attacker-controlled flow data\u00a0(containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to\u00a0exec()\u00a0with zero sandboxing, resulting in unauthenticated remote code execution.\u201d reads the advisory. \u201cThis is distinct from\u00a0CVE-2025-3248, which fixed\u00a0\/api\/v1\/validate\/code\u00a0by adding authentication. The\u00a0build_public_tmp\u00a0endpoint is\u00a0designed\u00a0to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\u201d<\/p>\n<p>According to\u00a0Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/p>\n<p>Experts also recommend that private organizations review the\u00a0Catalog\u00a0and address the vulnerabilities in their infrastructure.<\/p>\n<p>CISA orders federal agencies to fix the vulnerability by\u00a0April 8, 2026.<\/p>\n<p>In May 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added another Langflow flaw, tracked as\u00a0CVE-2025-3248\u00a0(CVSS score of 9.8), to its\u00a0Known Exploited Vulnerabilities (KEV) catalog.<\/p>\n<p>CVE-2025-3248 is a code injection vulnerability in the\u00a0\/api\/v1\/validate\/code\u00a0endpoint. A remote, unauthenticated attacker can exploit it by sending crafted HTTP requests to execute arbitrary code. The flaw impacts versions prior to 1.3.0.<\/p>\n<p>Researchers from cybersecurity firm Horizon3.ai discovered the vulnerability and pointed out that it is easily exploitable.<\/p>\n<p>Pierluigi\u00a0Paganini<\/p>\n<p>Follow me on Twitter:\u00a0@securityaffairs\u00a0and\u00a0Facebook\u00a0and\u00a0Mastodon<\/p>\n<p>(SecurityAffairs\u00a0\u2013\u00a0hacking, US CISA\u00a0Known Exploited Vulnerabilities catalog)<\/p>\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog https:\/\/securityaffairs.com\/190018\/security\/u-s-cisa-adds-a-langflow-flaw-to-its-known-exploited-vulnerabilities-catalog.html Publish Date:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":199506,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/securityaffairs.com\/wp-content\/uploads\/2020\/07\/CISA.jpeg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,31,27],"class_list":["post-199505","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/199505"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=199505"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/199505\/revisions"}],"predecessor-version":[{"id":199507,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/199505\/revisions\/199507"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/199506"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=199505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=199505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=199505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}