CVE-2026-33017: Langflow Code Injection Vulnerability

let LangflowPorts = dynamic([7860, 7861, 3000]);
let SuspiciousPaths = dynamic(["/api/v1/run", "/api/v1/process", "/api/v1/predict", "/api/v1/build"]);
let CodeInjectionPatterns = dynamic(["__import__", "exec(", "eval(", "os.system", "subprocess", "__builtins__", "compile(", "open(", "socket."]);
union DeviceNetworkEvents, CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(24h)
| where (DestinationPort in (LangflowPorts) or cs-port in (LangflowPorts))
| where (cs-uri-stem has_any (SuspiciousPaths) or RequestURL has_any (SuspiciousPaths))
| extend RequestBody = coalesce(column_ifexists("RequestBody", ""), column_ifexists("cs-uri-query", ""))
| where RequestBody has_any (CodeInjectionPatterns)
| project TimeGenerated, SourceIP = coalesce(SourceIP, cIP, c-ip), DestinationIP = coalesce(DestinationIP, ""), RequestURL = coalesce(RequestURL, cs-uri-stem, ""), RequestBody, Method = coalesce(RequestMethod, cs-method, ""), StatusCode = coalesce(EventResultDetails, sc-status, "")
| extend RiskScore = case(
    RequestBody has "__import__" and RequestBody has "os", 95,
    RequestBody has "subprocess", 90,
    RequestBody has "exec(" or RequestBody has "eval(", 85,
    70)
| where RiskScore >= 70
| order by RiskScore desc

index=web OR index=network OR index=proxy
(dest_port=7860 OR dest_port=7861 OR dest_port=3000)
(uri_path="/api/v1/run" OR uri_path="/api/v1/process" OR uri_path="/api/v1/predict" OR uri_path="/api/v1/build")
| eval request_body=coalesce(request_body, form_data, uri_query)
| search request_body IN ("*__import__*", "*exec(*", "*eval(*", "*os.system*", "*subprocess*", "*__builtins__*", "*compile(*", "*socket.*")
| eval risk_score=case(
    match(request_body, "__import__.*os"), 95,
    match(request_body, "subprocess"), 90,
    match(request_body, "exec\\(|eval\\("), 85,
    true(), 70)
| where risk_score >= 70
| stats count AS request_count, values(uri_path) AS endpoints, values(http_method) AS methods, max(risk_score) AS max_risk, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip
| where request_count >= 1
| eval severity=case(max_risk >= 90, "critical", max_risk >= 80, "high", true(), "medium")
| sort - max_risk

sequence by source.ip with maxspan=5m
  [network where destination.port in (7860, 7861, 3000)
   and http.request.method in ("POST", "PUT", "PATCH")
   and http.request.body.content regex~ ".*(__import__|exec\\(|eval\\(|os\\.system|subprocess|__builtins__|compile\\(|socket\\.).*"]
  [any where event.category == "process"
   and process.parent.name in ("python", "python3", "uvicorn", "gunicorn")
   and process.name in ("sh", "bash", "curl", "wget", "nc", "ncat", "python", "python3")]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  'Request Body' AS req_body_field,
  starttime,
  eventcount,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  destinationport IN (7860, 7861, 3000)
  AND (URL ILIKE '%/api/v1/run%' OR URL ILIKE '%/api/v1/process%' OR URL ILIKE '%/api/v1/predict%' OR URL ILIKE '%/api/v1/build%')
  AND (
    UTF8(payload) ILIKE '%__import__%'
    OR UTF8(payload) ILIKE '%exec(%'
    OR UTF8(payload) ILIKE '%eval(%'
    OR UTF8(payload) ILIKE '%os.system%'
    OR UTF8(payload) ILIKE '%subprocess%'
    OR UTF8(payload) ILIKE '%__builtins__%'
    OR UTF8(payload) ILIKE '%socket.%'
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS', 'F5 BIG-IP', 'Palo Alto Networks Firewall')
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=web* OR _sourceCategory=proxy* OR _sourceCategory=nginx* OR _sourceCategory=apache*
| where (%"dest_port" in ("7860", "7861", "3000") or %"server_port" in ("7860", "7861", "3000"))
| where %"uri_path" matches "/api/v1/run*" or %"uri_path" matches "/api/v1/process*" or %"uri_path" matches "/api/v1/predict*" or %"uri_path" matches "/api/v1/build*"
| where %"request_body" matches "*__import__*" or %"request_body" matches "*exec(*" or %"request_body" matches "*eval(*" or %"request_body" matches "*os.system*" or %"request_body" matches "*subprocess*" or %"request_body" matches "*__builtins__*"
| eval risk = if(%"request_body" matches "*__import__*os*", "critical", if(%"request_body" matches "*subprocess*", "critical", "high"))
| count as hit_count by %"src_ip", %"dest_ip", %"uri_path", risk
| order by hit_count desc

rule cve_2026_33017_langflow_code_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-33017 Langflow code injection exploitation attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx"
    
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.application_protocol = "HTTP"
    (
      $http.target.port = 7860 or
      $http.target.port = 7861 or
      $http.target.port = 3000
    )
    (
      $http.network.http.request_url = /\/api\/v1\/(run|process|predict|build)/
    )
    (
      $http.network.http.request_body = /__import__|exec\(|eval\(|os\.system|subprocess|__builtins__|socket\./
    )
    
  condition:
    $http
}

#event_simpleName=NetworkReceiveAcceptIP4 OR #event_simpleName=NetworkReceiveAcceptIP6
| LocalPort IN (7860, 7861, 3000)
| RemoteIP != "127.0.0.1"
| join(#event_simpleName=ProcessRollup2
  | ImageFileName = /python[23]?$|uvicorn|gunicorn/i
  | groupby([aid, TargetProcessId], function=collect([CommandLine, ImageFileName]))
  , field=aid, include=[CommandLine, ImageFileName], kind=left)
| groupby([RemoteIP, LocalPort, aid], function=[count(as=connection_count), collect(CommandLine)])
| CommandLine = /__import__|exec\(|eval\(|os\.system|subprocess|socket\./
| sort(connection_count, order=desc)