Security1 publisher2 min readPublished
A nuclei template hit Langflow's unauthenticated build endpoint 20 hours after disclosure
One HTTP request runs Python on an exposed Langflow server, and Sysdig's honeypots logged exploit attempts inside a day of the March 17 advisory, before any public proof-of-concept existed. The traffic identified itself as nuclei.
The Watch · Security desk
What happened
- Sysdig's Threat Research Team observed the first exploitation attempts about 20 hours after the advisory went out, with no public proof-of-concept repository on GitHub at that point.
- The payload ran id, base64-encoded the output and sent it to a per-request interactsh subdomain, with the same code template across every source address.
- Sysdig says exfiltrated information included keys and credentials that provided access to connected databases and opened potential software supply chain compromise.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The vulnerable endpoint is unauthenticated by design, so no misconfiguration is needed to be in scope: every internet-reachable Langflow instance is reachable by anyone who can send one POST.
- constraint Teams whose emergency change process fires on a CISA catalog entry have nothing to fire on here, because the CVE is absent from KEV while exploitation is confirmed.
- decision When an advisory that names the path and the injectable field is enough to build the exploit, the patch call on exposed AI orchestration tooling has to be made on advisory day.
- contradiction Sysdig's credential and database access finding sits above traffic it documents as one operator running id checks, and the post does not tie the stolen material to the six timestamped IPs.
The endpoint needs no auth bypass. POST /api/v1/build_public_tmp/{flow_id}/flow exists so unauthenticated users can build public flows, and it accepts attacker-supplied flow data carrying Python in the node definitions, which the server then executes without a sandbox [3]. The chain is one HTTP request with no credentials [2].
Sysdig stood up honeypot nodes running vulnerable Langflow instances across multiple cloud providers and regions within hours of the advisory [7]. The first exploit request landed at 16:04:57 UTC [10]. Three more identical payloads followed from different addresses, the last at 16:39:32, a window of 34 minutes and 35 seconds [19]. Sysdig attributes those four to one operator scanning through proxies or VPS nodes [9]. Four of the six unique source IPs it recorded across the full 48 hours arrived inside that half hour [8][20]. Roughly 20 hours separated publication from the first request, putting the advisory near 20:00 UTC on March 17 [4][21].
The traffic named itself. Every exploit request carried Cookie: client_id=nuclei-scanner, and the flow created immediately before it was named nuclei-cve-2026-33017 [12]. One address rotated seven User-Agent strings across eight requests, including strings from nuclei's random User-Agent wordlist [13].
Running id and posting the base64 output to a unique interactsh subdomain confirms code execution and takes nothing else [11]. Sysdig's post also says exfiltrated information included keys and credentials, which provided access to connected databases and potential software supply chain compromise [14]. It does not connect that material to the six timestamped source IPs it documents.
Sysdig's write-up called what followed "a textbook demonstration of how quickly modern threat actors are operationalizing new vulnerabilities" [18]. The engineering it took was thin: a nuclei template needs a request path and a field to inject into, and the advisory published both, along with the code injection mechanism through flow node definitions [6]. No public proof-of-concept repository existed on GitHub when the first request arrived [5].
CISA added the earlier Langflow RCE, CVE-2025-3248, to the Known Exploited Vulnerabilities catalog in May 2025 [15]. CVE-2026-33017 has not been added, with exploitation confirmed [16]. That leaves the CVE with no remediation deadline attached to it. Langflow has more than 145,000 GitHub stars, a popularity count, and Sysdig publishes no figure for internet-facing instances [17].
What to watch
- Whether CISA adds CVE-2026-33017 to the Known Exploited Vulnerabilities catalog, as it did with CVE-2025-3248 in May 2025.
- Whether a public proof-of-concept or template lands and the source IP count moves past six.
- Whether follow-on payloads on the honeypots shift from id callbacks to reading credentials out of flow definitions.