CVE-2026-33017 Exploit Metadata

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-09

Technical assessment

The artifact contains a Python script (exploit.py) that sends a crafted HTTP POST request to the unauthenticated /api/v1/build_public_tmp/{flow_id}/flow endpoint of a vulnerable Langflow instance. The request body includes a malicious custom component with Python code that establishes a reverse shell back to an attacker-controlled listener. The script also includes a built-in listener to receive the shell.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the documented CVE-2026-33017 vulnerability by sending a crafted request to the vulnerable endpoint. The exploit.py script builds a payload containing a reverse shell, which is the expected exploit behavior for an RCE PoC. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit was observed.

ClassificationExploit

Model confidence100%

AuthenticationNot required

LanguagesPythonMarkdown

Target softwareLangflow

Attack typesRemote Code ExecutionCode InjectionEval Injection

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a complete, functional Python script (exploit.py) that actively exploits CVE-2026-33017 by sending a crafted request to execute arbitrary code and establish a reverse shell on the target server. This is code intended to exercise a vulnerability, not merely detect or report it.

exploit.py:1-130README.md:107-109

Requirements

A running, vulnerable Langflow instance (prior to 1.9.0) with a public flow ID.README.md:11-16README.md:22
An attacker-controlled listener (netcat or the script's built-in listener) to receive the reverse shell.README.md:27-31

Observed behavior

The exploit script constructs a JSON payload containing a custom component with embedded Python code that imports socket and subprocess, connects to a specified IP and port, and spawns an interactive bash shell.exploit.py:9-24
The script sends an unauthenticated POST request to the target endpoint with the malicious payload.exploit.py:108-117
The script optionally starts a built-in TCP listener to catch the reverse shell and provides an interactive command interface.exploit.py:56-87

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell: socket.connect to attacker-controlled host and port, followed by subprocess.Popen(['/bin/bash','-i'])This is the core exploit payload for the documented RCE vulnerability. It is not a hidden backdoor; it is the intended demonstration of the CVE.exploit.py:18-22README.md:141
Listener: Built-in TCP listener in exploit.py that accepts a connection and provides an interactive shellThis is a convenience feature for the PoC user, not a backdoor. It simply receives the reverse shell connection initiated by the exploit payload.exploit.py:56-87

Review boundaries

What the analysis did not establish

The evidence packet reports complete_artifact_coverage as false and one file (entrypoint.sh) is omitted from the text content, but the exploit logic is fully present in the provided files.
One file (entrypoint.sh) was omitted from the text evidence and was not reviewed. Its metadata was present but content was not supplied.
Binary files were not present in the evidence.
The review is limited to the supplied text content and does not include dynamic analysis or execution.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

Repository root

Created 2026-03-31Vuln labCVE-2026-33017Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Environment assessment

A Docker-based environment for reproducing CVE-2026-33017, a remote code execution vulnerability in Langflow. It uses a vulnerable Langflow 1.8.1 image, sets up a public flow with a fixed ID, and provides an exploit script that sends a malicious custom component to the unauthenticated build_public_tmp endpoint to achieve a reverse shell.

dockerfile:1-16entrypoint.sh:1-44exploit.py:1-130README.md:1-350

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2026-33017, provides setup and exploitation instructions, and the included Dockerfile and exploit script are designed to demonstrate the vulnerability in a controlled lab environment.

README.md:1-4README.md:7-12README.md:16-30

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Vulnerable Langflow service

vulnerable target application

A Langflow 1.8.1 instance configured with a superuser and a pre-created public flow with a fixed UUID. It exposes port 7860 and runs the entrypoint script that starts Langflow, logs in, and creates the public flow.

dockerfile:1-16entrypoint.sh:1-44

Exploit script (exploit.py)

exploit delivery tool

A Python script that crafts a malicious JSON payload containing a custom component with embedded reverse shell code, sends it to the vulnerable build_public_tmp endpoint, and optionally starts a listener to catch the shell.

exploit.py:1-130

Entrypoint script (entrypoint.sh)

lab environment initializer

Starts the Langflow server, waits for it to be ready, logs in using the configured superuser credentials, and creates a public flow with a fixed ID to serve as the exploitation target.

entrypoint.sh:1-44

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-33017

Supported by supplied evidence

The README describes the vulnerability as an unauthenticated RCE in the build_public_tmp endpoint due to accepting attacker-supplied flow data, and the exploit script demonstrates sending a malicious custom component to that endpoint. The Dockerfile uses a vulnerable version (1.8.1) and the entrypoint creates the required public flow.

README.md:34-38README.md:40-56exploit.py:1-130dockerfile:1entrypoint.sh:1-44

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build and run the vulnerable environment.README.md:9-12
The attacker must know or be able to discover the UUID of a public flow on the target Langflow instance. The lab pre-creates one with ID 00000000-0000-0000-0000-000000000001.README.md:16-18entrypoint.sh:20
The attacker needs network connectivity to the target Langflow server on port 7860 and a listener to receive the reverse shell.README.md:16-30

Evidence-described exercise path

Build the Docker image using the provided Dockerfile.README.md:9-10
Run the container, which starts Langflow, logs in, and creates a public flow with a fixed ID.README.md:11-12entrypoint.sh:1-44
Start a listener (e.g., netcat) on the attacker's machine.README.md:18-20
Run the exploit script with the target URL, flow ID, and callback address to send the malicious payload and receive a reverse shell.README.md:22-24exploit.py:1-130

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target. The exploit script sends a payload to the local Langflow instance and establishes a reverse shell within the container. There is no evidence of host escape, external connections beyond the documented callback, persistence mechanisms, credential theft, or destructive actions outside the intended lab exercise.

exploit.py:1-130dockerfile:1-16entrypoint.sh:1-44

Review boundaries

What the analysis did not establish

The packet does not include a Compose file, so port mapping and privileged mode cannot be assessed; the Dockerfile alone does not specify runtime flags.
The exploit script hardcodes a reverse shell to an attacker-controlled IP, which is expected for the exercise but could be misused if pointed at an external target; the packet itself does not demonstrate such misuse.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-33017