CISA sounds alarm on Langflow RCE, Trivy supply chain compromise after rapid exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files. Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable. | 9.3 | 96% | KEV PoC ×4 |
| moderateon the order of several thousand internet-exposed Langflow instances (estimate) | |
| CVE-2026-33634 | Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases CVE-2026-33634 is an embedded malicious code (supply chain) vulnerability in which a threat actor using compromised Aquasecurity credentials published a backdoored Trivy v0.69.4 release on March 19, 2026, force-pushed 76 of 77 version tags in the aquasecurity/trivy-action GitHub Action to credential-stealing malware, and replaced all 7 tags in aquasecurity/setup-trivy with malicious commits. The malicious code executes when CI/CD pipelines pull or run the affected Trivy Go module/container image or when workflows resolve the compromised mutable version tags, including runs on March 19-20, 2026 that referenced tags instead of pinned commit SHAs. An attacker gains code execution in developer CI environments and can steal secrets (cloud, registry, and other credentials accessible to affected pipelines), with a repository named 'tpcp-docs' appearing in an organization indicating the fallback exfiltration mechanism fired and secrets were taken. Anyone who pulled or executed Trivy 0.69.4 or referenced affected trivy-action (0.0.1-0.34.2) or setup-trivy (0.2.0-0.2.6) tags is affected, and related malicious LiteLLM releases tied to the same campaign may have exposed 2,100+ organizations. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on March 26, 2026, EPSS estimates a 59.2% probability of exploitation within 30 days, and the FBI reports the TeamPCP actor compromised developer tools to steal cloud credentials. Do: Move to known-safe releases - Trivy 0.69.2/0.69.3 (avoiding 0.69.4), trivy-action 0.35.0, and setup-trivy 0.2.6 as recreated with a safe commit - and remove any pulled or executed Trivy 0.69.4 artifacts. Treat all secrets accessible to affected pipelines as exposed and rotate them immediately; check workflow run logs from March 19-20, 2026 for tag-referencing workflows, look for a 'tpcp-docs' repository in your GitHub organization as an exfiltration indicator, and pin all GitHub Actions to full, immutable commit SHAs. Per the CISA KEV required action, apply vendor mitigations or follow applicable BOD 22-01 guidance for cloud services. | 9.4 | 59% | KEV PoC ×2 |
| largetens of thousands of repositories/CI pipelines (related malicious LiteLLM releases alone were reported to have exposed 2,100+ organizations) |
Full article601 words · extracted from helpnetsecurity.com · click to collapse
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities catalog:
- CVE-2026-33017, a recently disclosed code injection vulnerability in Langflow, an open-source framework for building AI agents and workflows, and
- CVE-2026-33634, an embedded malicious code vulnerability in Aqua Security’s Trivy security scanner.
Their addition to the catalog means that US federal civilian agencies are required to address the flaws within their networks by April 8 and 9, respectively.
About CVE-2026-33017
CVE-2026-33017 is a critical vulnerability stemming from several security weaknesses and affects Langflow versions 1.8.2. and earlier. It may allow unauthenticated attackers to remotely execute code on a Langflow instance via a public flow build endpoint.
A very detailed security advisory for CVE-2026-33017 was made broadly visible on GitHub on March 17, 2026, and apparently had enough information for attackers to develop an exploit and start using it.
“Within 20 hours of the advisory’s publication, the Sysdig Threat Research Team (TRT) observed the first exploitation attempts in the wild,” the cloud security company shared.
“No public proof-of-concept (PoC) code existed at the time. Attackers built working exploits directly from the advisory description and began scanning the internet for vulnerable instances. Exfiltrated information included keys and credentials, which provided access to connected databases and potential software supply chain compromise.”
The occurrence serves as another confirmation of the shrinking window between “advisory publication” and “active exploitation”, Sysdig researchers noted.
“The collapse from months-long exploitation timelines to same-day weaponization is a structural shift in how vulnerabilities are exploited today. Organizations that rely on scheduled patch cycles to address critical vulnerabilities are operating on a timeline that attackers have already outpaced. Runtime detection, network segmentation, and rapid response capabilities are essential to bridging the gap between disclosure and remediation.”
It should be pointed out that Aviral Srivastava, the discoverer of CVE-2026-33017, unearthed the flaw while checking out how Langflow maintainers fixed CVE-2025–3248, a previously exploited vulnerability in the same code base.
This allowed him to pinpoint the same class of vulnerability, but on a different endpoint. It’s therefore also possible (though less likely) that attackers followed a similar approach.
About CVE-2026-33634
The CVE-2026-33634 identifier has been assigned to allow security teams to follow the ramifications of the Trivy supply chain compromise.
This compromise, which has been attributed to TeamPCP, happened on March 19, 2026, and allowed attackers to:
- Publish a malicious Trivy v0.69.4 release
- Force-push version tags in ‘aquasecurity/trivy-action’ to credential-stealing malware
- Replace all tags in ‘aquasecurity/setup-trivy’ with malicious commits
- Push out malicious trivy images on Docker Hub.
It also likely led to the LiteLLM supply chain attack, which resulted in compromised LiteLLM packages being published on PyPI.
Aqua Security outlined the incident and advised on recommended action for those that have been affected, and is expected to provide a meaningful update on their investigation in the coming days.
BerriAI, the creators of LiteLLM, have paused the release of new LiteLLM packages, and they’ve called in Mandiant to do a complete supply chain security review. According to Wiz researchers, LiteLLM is present in 36% of cloud environments they monitor, “signifying the potential for widespread impact.”
Both organizations have provided remediation instructions for affected users and developers.
In a public alert, the German Federal Office for Information Security (BSI) said that a number of compromises were reported them in the wake of and related to the Trivy attack. “According to current information, no data is believed to have been exfiltrated,” they said.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/03/27/cve-2026-33017-cve-2026-33634-exploited/