Download the latest Vulnerability & Exploitation Report

Download now

CrowdSec

VulnTracking

CVE-2026-33497: Langflow Path Traversal Exposes JWT Signing Key to Unauthenticated Attackers

CVE-2026-33497 is a CVSS 8.7 path traversal flaw in Langflow before 1.7.1. One unauthenticated GET request reads any file the application can open, including the secret_key that signs Langflow’s login tokens. Between August 19 and August 31, 2026, CrowdSec observed 275 unique IP addresses sending matching requests. Upgrade, then rotate the key.

CVE-2026-33497 at a glance

  • Affected: Langflow (pip package langflow) all versions before 1.7.1
  • Fixed in: 1.7.1. The same endpoint was hardened again in 1.9.0 (April 14, 2026); current release is 1.11.5 (August 25, 2026)
  • Vulnerability class: Path traversal in the profile-picture download endpoint (CWE-22)
  • Severity: CVSS 4.0 8.7 High, scored by GitHub as CNA. NVD scores the same flaw CVSS 3.1 7.5 High
  • Authentication required: None
  • Public exploit: Yes. The advisory publishes a one-line curl proof of concept, and a Nuclei template was merged on July 13, 2026
  • CISA KEV: Not listed as of catalog version 2026.08.27. Six other Langflow CVEs are listed, the most recent added August 4, 2026
  • CrowdSec detection rule live since: August 3, 2026
  • First exploitation attempt observed: August 19, 2026
  • Exploitation phase: Limited Exploitation
  • Observation window used here: Signal counts cover August 19 to August 30, 2026 (12 days). The 275 unique-IP count covers August 19 to August 31, 2026.

Key findings

  • The advisory beat the attackers by five months; the detection rule by 16 days: GitHub published the advisory on March 20, 2026. Little happened until a public Nuclei template landed on July 13. CrowdSec shipped a detection rule on August 3, and the first matching request arrived on August 19, five weeks after the template.
  • 457 signals from 275 unique IP addresses, concentrated into four days: The 12-day window averages 38 signals a day, but the curve is not flat. Activity was negligible until August 25, climbed for four days, peaked at 127 signals from 72 distinct sources on August 28, then fell to 17 on August 30.
  • The attack is one request, and it steals a signing key: curl --path-as-is'http://<host>:7860/api/v1/files/profile_pictures/../secret_key' returns the raw key Langflow uses to sign every JWT. With it, an attacker mints valid tokens for any account, including administrators. No credentials, no chaining, no second stage.
  • Two-thirds of the source addresses are in one cloud region: Of the 251 addresses CrowdSec CTI held for this CVE over the 30 days to August 31, 161 belong to Amazon, and 157 of those geolocate to Dublin, AWS eu-west-1. Not one Irish address in the set sits outside AWS.

What is Langflow, and who is exposed to CVE-2026-33497?

Langflow is an open-source visual builder for AI agents, workflows, and MCP servers. Teams use it to wire models, prompts, tools, and business data together without writing the plumbing, so the people running it are usually developers and platform engineers rather than a security team, and the instance often starts as an internal prototype that quietly acquired a public IP.

Why CVE-2026-33497 matters: Langflow’s secret_key signs its authentication tokens, so reading it is not an information leak in the usual sense. It is a skeleton key. Whoever holds it forges a token for the administrator account and gains legitimate access to whatever the instance connects to: model API credentials, internal knowledge bases, database connectors, the flows themselves. The same request also reads any other file the process can open.

Among the organizations whose machines reported these attempts to the CrowdSec Network, 79% are in commerce, 12% are small offices or home setups, and 75% fall into our technology-business risk profile. The reporting machines cluster in France (42%), Poland (10%), Germany (10%), and the United States (6%). That describes where CrowdSec has visibility, not where Langflow is deployed.

How does CVE-2026-33497 work?

The download_profile_picture function in src/backend/base/langflow/api/v1/files.py served GET /api/v1/files/profile_pictures/{folder_name}/{file_name} by concatenating the two path parameters onto a base directory and handing the result to the filesystem. No sanitisation, and no check that the resolved path stayed inside the intended folder, so ../secret_key walks straight out of it. The endpoint needs no authentication because profile pictures render on the login screen, a missing containment check on the one endpoint in the file nobody expected to need one.

One detail worth borrowing if you audit your own code: 1.7.1 fixed this by rejecting .. and comparing the resolved path with startswith(). String-prefix comparison on paths is a known source of near-misses, so in March 2026 Langflow replaced it with typed parameter validation at the FastAPI layer plus Path.is_relative_to(). That hardening shipped in 1.9.0.

What is the CrowdSec Network observing for CVE-2026-33497?

Between August 19 and August 30, 2026, the CrowdSec Network recorded 457 signals from machines reporting requests matching the CVE-2026-33497 exploitation pattern, detected by the CrowdSec scenario released on August 3, 2026. That averages 38 signals a day, peaking at 127 on August 28 from 72 distinct sources. Over August 19 to August 31, the network counted 275 unique IP addresses sending matching requests.

Sources concentrate in Ireland (61%), the United States (15%), the Netherlands (7%) and Russia (5%). The Irish share is entirely Amazon capacity in Dublin; 157 of the 251 addresses CTI held over the 30 days to August 31 are AWS eu-west-1, and none of the Irish addresses are residential. That is rented infrastructure, spun up and discarded, not a consumer botnet. Of the intent our CTI classifies for these sources, 88% is infrastructure takeover, against 8% ransomware and 5% data exfiltration.

The shape matters more than the size here. A four-day burst that peaked on August 28 and had largely stopped by August 30, from hosts that are themselves new, 42 of the 251 addresses were first seen anywhere on the CrowdSec Network during August. That is what a scan-and-collect run looks like: get the key, store it, leave. If that reading is right, the traffic stopping is not the same as the risk ending.

What this data does not show

  • A matching request is an exploitation attempt. CrowdSec cannot confirm any succeeded; none of these figures are confirmed compromises.
  • 275 unique IP addresses is not 275 threat actors. One operator rotating through AWS instances produces many addresses, and the Dublin concentration makes that likelier than a large actor population.
  • These counts come from traffic reaching machines participating in the CrowdSec Network: a sample, not a census. The country breakdown reflects where CrowdSec has visibility.
  • The scenario matches the request pattern. It cannot separate a vulnerability scan from a genuine exploitation attempt, nor a researcher from an attacker, and it cannot see whether the response returned a real key or a 400.
  • The 12-day signal window and the 13-day unique-IP window differ, so the two headline numbers should not be divided into each other.

What defenders get wrong about CVE-2026-33497

Patching CVE-2026-33497 does not undo it. For most vulnerabilities, the upgrade ends the story; here the asset stolen is a cryptographic key, and upgrading stops the next read without invalidating what an attacker already took. A key lifted on August 28 still signs valid administrator tokens on the patched instance. The advisory says so, in the line easiest to skim past: rotate the secret_key if you cannot rule out exposure. If your instance was internet-facing and running below 1.7.1 at any point this month, you cannot rule it out.

The second thing to get right is what the Irish traffic means. Sixty-one percent of sources in Ireland tells you nothing about who is behind this and everything about where they rented their machines. Country-based blocking would drop most of the observed traffic today and none of it next week, when the same operator relaunches in another region.

Where the advice below has limits: request-level controls buy time; they do not replace the upgrade. A traversal filter can be bypassed by encoding tricks a purpose-built rule would catch, and CrowdSec ships no CVE-specific virtual-patching rule for CVE-2026-33497 today, so what follows is generic detection doing a specific job.

How do you protect Langflow against CVE-2026-33497?

  1. Patch, then rotate. Upgrade Langflow to 1.7.1 or later (advisory). With six other Langflow CVEs in CISA KEV, three added since July 2026, go to the current release rather than to the floor. Confirm what is running with pip show langflow before closing the ticket. Then rotate secret_key and force re-authentication, which invalidates any token forged from a stolen key.

2. Take it off the internet. Langflow listens on port 7860 and has no business being publicly reachable. Put it behind a VPN or an identity-aware proxy, the one control that would have made every CVE in this product’s KEV history a non-event.

3. Detect the traversal attempt. The CrowdSec AppSec Component inspects HTTP requests at the remediation component before they reach Langflow. No vpatch-CVE-2026-33497 rule exists on the Hub, so use the OWASP Core Rule Set, its REQUEST-930-APPLICATION-ATTACK-LFI rules match the traversal sequence with the log-based crowdsecurity/http-path-traversal-probing scenario behind it.

sudo cscli collections install crowdsecurity/appsec-crs-inband

sudo cscli collections install crowdsecurity/base-http-scenarios

sudo systemctl reload crowdsec

sudo cscli appsec-configs list

sudo cscli scenarios list | grep path-traversal

Working correctly, a matching request gets an HTTP 403 from the remediation component and the decision appears in cscli alerts list. These are generic rules, so validate against your own traffic before enabling inband blocking.

4. Preemptive blocking. Subscribe to the CrowdSec Intelligence Blocklists to drop addresses already seen attacking the network. The limit is visible in this campaign’s own data: 42 of the 251 addresses were first observed during August, so a blocklist covers known infrastructure and will not stop a freshly rented host.

Stay proactive. Follow CVE-2026-33497 on the Live Exploit Tracker and query its sources in CrowdSec CTI.

Unsure where to start? Our 3-minute introduction track: https://start.crowdsec.net

Frequently asked questions about CVE-2026-33497

Is CVE-2026-33497 being exploited in the wild? Yes. CrowdSec first observed matching requests on August 19, 2026, and recorded 275 unique IP addresses through August 31, peaking at 127 signals on August 28 before falling sharply. CrowdSec classifies it as Limited Exploitation.

Which versions of Langflow are affected by CVE-2026-33497? All releases before 1.7.1, the first patched version. The endpoint was hardened further in 1.9.0; the current release is 1.11.5.

Can I mitigate CVE-2026-33497 without upgrading? Partly. Blocking /api/v1/files/profile_pictures/ at the reverse proxy stops the request, and taking Langflow off the public internet stops it more reliably. Neither helps if the key already leaked; that needs rotation, not filtering.

Related CrowdSec threat alerts

WRITTEN BY