Hackers Exploit Critical Langflow Bug in Just 20 Hours

Hackers exploit Langflow AI flaw in 20 hours, highlighting rapid vulnerability exploitation and security patch delays.

Mar 20, 2026

ON THIS PAGE

Cybercriminals exploited a critical vulnerability in Langflow, an open-source AI framework, within 20 hours of its disclosure on March 17. The bug (CVE-2026-33017) scored 9.3 on the severity scale and allows attackers to execute malicious code without authentication using just one HTTP request.

Sysdig researchers watched as hackers built working exploits directly from the security advisory, then scanned the internet for vulnerable systems. The attackers successfully harvested credentials, API keys, and database access from exposed instances.

This lightning-fast exploitation reflects a troubling trend: median time-to-exploit dropped from 771 days in 2018 to mere hours in 2024. Meanwhile, organizations typically take 20 days to deploy patches, leaving them dangerously exposed.

Source: Infosecurity Magazine

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?