Langflow unauthenticated RCE exploitation and secret theft

Attackers are exploiting **CVE-2026-33017** in **Langflow**, a flaw that lets a remote user run attacker-controlled Python code on exposed instances without authentication. The weakness combines missing authentication with code injection in the public build endpoint, and affected versions run through **1.8.1** with **1.9.0.dev8** identified as the addressed build. Exploitation began within 20 hours of public disclosure, and available evidence indicates attackers could build working exploits directly from the advisory description. Early activity moved from scanning to custom Python scripts that targeted files and environment data such as **/etc/passwd** and **.env**. Automated requests from four source IPs using the same payload point to a shared wave against exposed Langflow deployments. Follow-on activity included theft of keys, credentials, databases, cloud credentials, and configuration files, plus callback traffic to **173.212.205[.]251:8443**. CISA added **CVE-2026-33017** to the Known Exploited Vulnerabilities catalog with a required action date of **2026-04-08**, and the addressed build is **1.9.0.dev8**. Available evidence does not quantify how many servers were hit, but exposed Langflow instances remain at immediate risk if they are still unpatched or reachable from the internet.