CISA Warns of Langflow Code Injection Vulnerability Exploited in Attacks

**Executive Summary:** CISA added CVE-2026-33017, a critical unauthenticated code-injection vulnerability in the Langflow low-code AI workflow platform, to its Known Exploited Vulnerabilities catalog on March 25, 2026; the flaw is actively being exploited and allows remote attackers to build and execute public flows without credentials, enabling data theft, workflow manipulation, and lateral movement—CISA mandates rapid remediation or discontinuation until a verified fix is available.