Langflow build_public_tmp Exploitation Indicators (CVE-2026-33017)

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•0•62

This detection identifies attempts to exploit CVE-2026-33017, a code injection vulnerability in Langflow, by looking for specific URL paths associated with the vulnerability ('/api/v1/build_public_tmp/') combined with indicators of scanning tools like 'nuclei' in the user agent or cookie fields. It aims to detect reconnaissance or exploitation attempts against vulnerable Langflow instances.