🛡️ CVE-2026-33017

The items that name it 6

• Rumour Is the Exploit — AI agents collapse time-to-exploit to near-zero
  article2026-08-22It is written here as CVE-2026-33017 (Langflow; first exploitation took 20 hours).

  Langflow; first exploitation took 20 hours

• AI Security Briefing
  advisory2026-07-18

  Unauthenticated remote code execution flaw in Langflow.

• Orca Security: Langflow RCE (CVE-2026-33017) Actively Exploited
  advisory2026-07-02

  Critical unauthenticated remote code execution vulnerability in Langflow via the public flow-building API endpoint /api/v1/build_public_tmp/{flow_id}/flow, caused by lack of input sanitization and sandboxing for user-supplied flow definitions, allowing arbitrary Python code execution. CVSS 9.8. Adde

• Orca: CVE-2026-5027 Langflow Path Traversal RCE
  advisory2026-06-12

  Prior Langflow vulnerability cited as evidence of sustained adversary interest in agentic AI applications infrastructure.

• Vulnerability Garden
  tool2026-05-13
• Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10 Hours | Sysdig
  writeup2026-04-09

  Langflow flaw referenced for comparison; exploited within 20 hours of disclosure with no public exploit available.