CISA: New Langflow Flaw Actively Exploited to Hijack AI Workflows

CISA: New Langflow flaw actively exploited to hijack AI workflows

The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents.

Langflow RCE flaw exploited within hours, CISA warns

CISA flags CVE-2026-33017 in Langflow as actively exploited. The RCE flaw scored 9.3 and was weaponised within 20 hours of disclosure.

Attackers exploit critical Langflow RCE within hours as CISA sounds alarm

Attackers have exploited a critical Langflow RCE within hours of disclosure, prompting the US Cybersecurity and Infrastructure Security Agency (CISA) to formally flag it for urgent remediation. The flaw, which allows running arbitrary code on vulnerable Langflow instances without >credentials, was weaponized within 20 hours of the open-source AI-pipeline tool disclosing it. According to a Sysdig report, crooks started hitting a fleet of honeypot…

U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA adds a Langflow flaw to its Known Exploited Vulnerabilities catalog Pierluigi Paganini March 26, 2026 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Langflow to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Langflow flaw, tracked as CVE-2026-33017 (CVSS score of 9.3), to its Known Exploited Vulnerabilities (KEV) cata…

CISA Warns of Langflow Code Injection Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical security flaw affecting the Langflow platform to its Known Exploited Vulnerabilities (KEV) catalog on March 25, 2026. The vulnerability, tracked as CVE-2026-33017, involves a highly dangerous code injection issue that is currently being actively exploited in the wild. Langflow operates as a popular […] The post CISA Warns of Langflow Code Injection Vulner…