DAI-SS EXPLOIT CVE-2026-33017 - Possible Langflow RCE Attempt Inbound

David Wharton@whartond

•updated Mar 24, 2026•3•0•85

This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.