⚡️ 0-Day Alert: IBM LangFlow OSS RCE

LangFlow deployments have been under active exploitation since May.

CVE-2025-34291: CORS misconfiguration + SameSite=None

CVE-2026-33017*: Unauthenticated RCE via build_public_tmp's data parameter

CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID

CVE-2026-0770: Unauthenticated RCE via validate_code() / decorator abuse

CVE-2026-9198: Unauthenticated RCE via auto_login + validate/code chain

Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist.

Majority pattern: takes input from an API endpoint variable and executes it directly on the OS.

Attack pattern suggests that LangFlow has not seen appropriate security hardening from the vendor, and shouldn't be deployed in environments where an arbitrary code execution poses a risk.

* Attached: 33017 diff and code trace to exec()