> ## Content Index
> Fetch the complete content index at: https://intelligence.zerodayengineering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# ⚡️ 0-Day Alert: IBM LangFlow OSS RCE
- URL: https://intelligence.zerodayengineering.com/0-day-alert-cve-2025-34291/
- Published: 2026-08-13T15:57:00.000Z
- Updated: 2026-09-17T16:40:55.000Z
- Description: LangFlow deployments have been under active exploitation since May.
- Author: Zero Day Engineering
- Tags: 0-Day Alerts

LangFlow deployments have been under active exploitation since May. 

CVE-2025-34291: CORS misconfiguration + SameSite=None 

CVE-2026-33017\*: Unauthenticated RCE via build\_public\_tmp's data parameter

CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID

CVE-2026-0770: Unauthenticated RCE via validate\_code() / decorator abuse

CVE-2026-9198: Unauthenticated RCE via auto\_login + validate/code chain

Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist.

Majority pattern: takes input from an API endpoint variable and executes it directly on the OS.

Attack pattern suggests that LangFlow has not seen appropriate security hardening from the vendor, and shouldn't be deployed in environments where an arbitrary code execution poses a risk.

\* Attached: 33017 diff and code trace to exec()