⚡️ 0-Day Alert: IBM LangFlow OSS RCE

LangFlow deployments have been under active exploitation since May.

CVE-2025-34291: CORS misconfiguration + SameSite=None
CVE-2026-33017*: Unauthenticated RCE via build_public_tmp's data parameter
CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID
CVE-2026-0770: Unauthenticated RCE via validate_code() / decorator abuse
CVE-2026-9198: Unauthenticated RCE via auto_login + validate/code chain

Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist.

Majority pattern: takes input from an API endpoint variable and executes it directly on the OS.

Attack pattern suggests that LangFlow has not seen appropriate security hardening from the vendor, and shouldn't be deployed in environments where an arbitrary code execution poses a risk.

* Attached: 33017 diff and code trace to exec()