CVE-2026-33017 Langflow Unauthenticated RCE Exploit Attempt
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
YARA-L
