Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-3248 | Unauthenticated RCE in Langflow /api/v1/validate/code Langflow, an open-source visual framework for building LLM and agentic AI applications, contains a missing authentication flaw (CWE-306) in its /api/v1/validate/code endpoint. A remote attacker with network reachability to the endpoint can send crafted HTTP requests without any credentials, causing arbitrary code execution on the server. Successful exploitation yields code execution under the application's privileges, enabling data theft, backdoor installation, and, per CISA, ransomware deployment. Any running Langflow instance is affected; the tool is typically self-hosted by development teams building AI workflows, so real-world exposure depends on whether each instance is reachable from untrusted networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2025-05-05 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days (100th percentile), and a public PoC is available. Do: Upgrade Langflow to the latest patched release identified in the vendor's advisory; federal agencies must apply mitigations per vendor instructions under BOD 22-01 or discontinue use if mitigations are unavailable. Until patched, restrict network access to the /api/v1/validate/code endpoint via reverse-proxy authentication, firewall rules, or VPN placement, and avoid exposing Langflow directly to the internet. Because ransomware use is confirmed, review access and process-execution logs for signs of prior compromise. | 9.8 | 100% | KEV ransomware PoC ×2 |
| moderatetens of thousands of self-hosted deployments, with likely only hundreds to low thousands directly exposed to the internet | |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files. Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable. | 9.3 | 96% | KEV PoC ×4 |
| moderateon the order of several thousand internet-exposed Langflow instances (estimate) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | ipinfo.io | s wiped from the file system. It further sends a request to ipinfo[.]io to obtain the host's public IP address and location, allo |
Full article720 words · extracted from thehackernews.com · click to collapse
Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner.
The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI) application endpoints for obtaining initial access to enterprise networks. The attack was observed over a 19-day window between March 27 and April 15, 2026.
"In this campaign, a single line of Python code evaluated inside an unauthenticated Langflow API endpoint pulls down a shell script, fetches a miner binary, and launches it detached," Trend Micro researchers Simon Dulude and John Zhang said in a technical report published last week.
At a high level, the malware is designed to terminate competing cryptocurrency miner processes associated with Kinsing, WatchDog, Rocke, and Outlaw, delete rival wallet and key material, disable host-level security controls, establish cron-based persistence, beacon to an external server ("83.142.209[.]214:80), and deploy a custom miner. It can also propagate to other systems through reused SSH keys, effectively turning an exposed Langflow instance into a pathway for broader compromise.
This involves exploiting the Langflow flaw to run an attacker-supplied Python script, which, in turn, is configured to launch a remotely hosted shell script that acts as a dropper whose primary responsibility is to check if a binary called "lambsys" is already running on the host.
Subsequently, it downloads the binary on the machine using curl or wget, launches it as a detached process, and spreads itself to every SSH-reachable host the victim can authenticate to. The binary, an ELF executable written in Go, is also engineered to disable AppArmor, Ubuntu's Uncomplicated Firewall, iptables, SELinux, the kernel NMI watchdog, and Alibaba Cloud's Aliyun agent.
In addition, the malware removes system logs to cover up the tracks, and removes the immutable attribute from files like "~/.ssh/," "~/.ssh/authorized_keys," "/etc/crontab," and "/etc/ld.so.preload," "/tmp/," "/var/tmp/," and "/var/spool/cron" in order to make its modifications, and then reapplies the immutable attribute to "/tmp/" and "/var/tmp/."
Illicit cryptocurrency mining operations are known to set the "chattr +i" attribute on these files to ensure that they cannot be modified, renamed, or deleted by any user, including the superuser. The binary's behavior reflects that the threat actor behind the operation is aware of persistence methods adopted by rival cryptojacking groups.
In the final stage, the binary contacts the same server to fetch a TAR archive and extracts from it a bespoke XMRig miner. Once the miner begins execution, the archive file is wiped from the file system. It further sends a request to ipinfo[.]io to obtain the host's public IP address and location, allowing the threat actors to make operational decisions on the fly.
The first is pool selection. Given that mining pools tend to be geographically distributed, connecting the miner to a pool near the victim can minimize latency and maximize hash rate. The second reason behind obtaining this information is geo-fencing, as it gives the threat actors a way to exclude victims in certain regions.
"Lambsys does not run its attack logic as Go functions," the researchers explained. "Instead, it forks a cascade of short-lived sh -c subprocesses, each executing one shell command (one pkill, one chattr, one sysctl). The design trades stealth for reliability. If one of 51 pkill commands fails, the failure is contained to that subprocess, and the other 50 carry on."
Trend Micro said an artifact belonging to the previous iteration of the same binary was compiled in May 2024, indicating that the threat actors behind the campaign have likely been iterating on the family for over two years, while taking steps to evade detection by antivirus tools.
Over the past year, a number of security flaws in Langflow have come under active exploitation. In June 2025, another critical vulnerability (CVE-2025-3248, CVSS score: 9.8) was abused to distribute the Flodrix botnet malware.
"This cryptocurrency-mining campaign shows how exposed AI application endpoints are becoming another route into enterprise environments," Trend Micro said. "The payload might be familiar, but the delivery vector is not. A Langflow vulnerability gives commodity cryptominer operators a new front door into systems running AI application infrastructure."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html