HackTheBox – Fireflow | Langflow RCE, JWT Bypass, MCP Abuse & Kubernetes Escape

In this HackTheBox machine walkthrough, we start with vhost fuzzing to discover flow.fireflow.htb running Langflow 1.8.2 — version fingerprinted straight from the playground status bar. We exploit CVE-2026-33017, an unauthenticated RCE via POST /api/v1/build_public_tmp/{flow_id}/flow that passes attacker-controlled Python directly to exec() with no sandbox, patching the PoC to add verify=False for the self-signed cert. Shell lands as the Langflow service user. We find credentials in /etc/langflow/.env for user nightfall and SSH in. In nightfall's home an .mcp/config.json reveals an internal MCP server on port 30080 with bot credentials. We authenticate, decode the JWT, spot role:user, then forge an alg:none token with role:admin (trailing dot matters — don't forget it) to hit the /api/v1/tools endpoint which executes arbitrary Python, giving us a shell inside a Kubernetes pod. The service account token has nodes/proxy permission, which lets us talk directly to the kubelet API — we enumerate running pods, identify the node-exporter pod with the host filesystem mounted at /host, and use a WebSocket exec script (since curl won't speak the kubelet's protocol) to read root.txt off the host. Two gotchas covered in depth: 1.8.2 is NOT patched despite what some advisories say, and every kubelet frame starts with a stream identifier byte you need to strip. 📂 Scripts and Commands: http://strikoder.com/writeups/fireflow 🏠 Room Link: https://www.hackthebox.com/machines/f... -------- ⏱️ Timestamps: -------- Follow me for more real-world hacking walkthroughs, live streams, and cert prep content 👇 💻 Labs GitHub: https://github.com/strikoder 🎥 Streams & Short Content Twitch:   / strikoder   Instagram:   / strikoder   TikTok:   / strikoder   💬 Community & Discussions Discord Server:   / discord   X (Twitter): https://x.com/Strikoder 📨 Official Contact LinkedIn:   / strikoder   Email: strikoder@gmail.com More videos coming soon on PNPT, and OSCP prep. Stay tuned, and thanks for the support! #cve202633017 #langflow #jwtnone #algnonejwt #mcpserver #kubernetes #kubelet #nodesproxy #k3s #nodeexporter #websocketexec #containerescape #serviceaccount #buildpublictmp #langflow182 #fireflowhtb #oscp #pt1 #hackthebox #tryhackme #portswigger #portswiggeracademy #activedirectory #linux #windows #ethicalhacking #cybersecurity #pentesting #ctf #infosec #enumeration #privilegeescalation #windowshacking #networksecurity #bugbounty #RedTeam #capturetheflag #hackingtools #cyberseclabs #hackermindset #Nmap #terminal #strikoder