# Critical Langflow RCE Weaponized in Coordinated Campaign to Deploy Monero Cryptominers on AI Infrastructure


## The Threat


Threat actors are actively exploiting a critical remote code execution vulnerability in Langflow—a popular open-source framework for building large language model (LLM) applications—to gain unauthorized access to enterprise networks and deploy cryptocurrency mining malware. The campaign, tracked across a 19-day window from March 27 through April 15, 2026, reveals a sophisticated attack chain that transforms exposed AI application endpoints into a beachhead for enterprise compromise.


The vulnerability, tracked as CVE-2026-33017, allows unauthenticated attackers to execute arbitrary Python code through an unprotected Langflow API endpoint. Threat actors weaponized this flaw by injecting a single line of Python that downloads and executes a shell script dropper, which subsequently fetches and launches a custom Monero cryptocurrency miner binary. The attack demonstrates a calculated understanding of operational security: the malware actively terminates competing cryptominers from rival threat groups (Kinsing, WatchDog, Rocke, and Outlaw), wipes system logs, and hardens its own persistence mechanisms to maintain exclusive access.


What makes this campaign particularly dangerous is its lateral movement capability. Once deployed on a compromised host, the "lambsys" binary exploits reused SSH credentials to propagate across the victim's infrastructure, effectively converting a single exposed Langflow instance into a pivot point for broader network penetration. By querying ipinfo.io for geolocation data, attackers perform real-time operational decisions—selecting mining pools with minimal latency and geo-fencing deployments away from certain regions to avoid detection or analysis.


## Severity and Impact


| Field | Value |

|-------|-------|

| CVE Identifier | CVE-2026-33017 |

| CVSS Score | 9.3 (Critical) |

| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Unchanged |

| Confidentiality Impact | High |

| Integrity Impact | High |

| Availability Impact | High |

| Exploitability | Active exploitation confirmed in the wild |


## Affected Products


  • Langflow — all versions prior to the security patch release

    • - Commonly deployed in containerized environments (Docker, Kubernetes)

    - Used by enterprises building AI/ML applications and LLM-based agents

    - Often exposed to internet-facing endpoints without proper authentication


    ## Mitigations


    Immediate actions:


  • Apply security patches immediately — Update Langflow to the latest patched version as soon as available. This is a critical vulnerability requiring emergency patching.
  • Network segmentation — Move Langflow deployments behind authentication layers (reverse proxy with API key validation, OAuth, or mTLS).
  • Restrict API access — Implement IP whitelisting and rate limiting on Langflow API endpoints. Disable public internet exposure unless explicitly required.
  • Audit exposed instances — Scan your infrastructure for exposed Langflow ports (default 7860). Use shodan.io, censys.io, or internal scanning tools to identify vulnerable endpoints.
  • Enable authentication — Require API keys or bearer tokens for all Langflow API calls. Do not rely on default configurations.

    • Detection and response:


  • Hunt for indicators of compromise:

    • - Check for unexpected outbound connections to 83.142.209[.]214:80 or unknown mining pools

    - Search logs for "lambsys" binary execution or downloads from external sources

    - Review SSH key usage and lateral movement patterns in authentication logs

    - Monitor for cron jobs or systemd services created outside normal administration windows

  • Kill running miners — Terminate any "lambsys" or XMRig processes. Use pkill -9 lambsys; pkill -9 xmrig.
  • Review system immutability settings — Attackers will set chattr +i on /tmp/, /var/tmp/, /etc/crontab, and SSH directories. Check and remove these attributes: lsattr -la /tmp/ && chattr -i /tmp/*.
  • Reset SSH credentials — Rotate all SSH keys and credentials that may have been compromised. Change passwords for all user accounts.
  • Review firewall logs — Inspect egress traffic for unknown destinations. Block mining pool domains and C2 infrastructure.

    • Hardening for the future:


  • Require authentication by default — Never deploy Langflow or similar services with unauthenticated API endpoints in production.
  • Use environment-based secrets management — Store API keys and credentials in secure vaults (HashiCorp Vault, AWS Secrets Manager), not configuration files.
  • Monitor resource consumption — Set up alerts for abnormal CPU usage, network traffic spikes, or unexpected process spawning.
  • Implement container security — Use container image scanning, runtime security monitors, and pod security policies to detect anomalies.
  • Apply principle of least privilege — Run Langflow with minimal required permissions; use Linux capabilities instead of running as root.

    • ## References


  • [Trend Micro Technical Report: Langflow RCE Campaign](https://www.trendmicro.com) — Detailed analysis by researchers Simon Dulude and John Zhang
  • [Langflow Official Repository](https://github.com/langflow-ai/langflow) — Security advisories and patch availability
  • [NVD CVE-2026-33017](https://nvd.nist.gov/vuln/detail/CVE-2026-33017) — National Vulnerability Database entry
  • [SANS Internet Storm Center](https://isc.sans.edu) — Community-contributed detection rules

    • ## HackWire Analysis


    This campaign exposes a critical blind spot in enterprise security: as organizations race to integrate AI and LLM infrastructure, they're often treating these components as internal tools rather than internet-facing attack surfaces. Langflow—despite being powerful for rapid application development—is frequently deployed by data science and ML teams without security controls typical of customer-facing APIs.


    The sophistication of this attack goes beyond simple cryptomining. The threat actors demonstrate encyclopedic knowledge of Linux security mechanisms (AppArmor, UFW, iptables, SELinux) and deliberately engineer their malware to defeat them. More tellingly, they've built operational awareness into the binary itself: geolocation checks, competing miner termination, and forensic cleanup reveal a threat group that learns from rivals. The 19-day active window suggests tactical reconnaissance—they were identifying vulnerable instances, testing deployments, and refining the attack before scaling.


    The lateral movement via SSH key reuse is the critical detail defenders should focus on. This vulnerability transforms from a single-host compromise into enterprise-wide penetration. Organizations running Langflow typically operate in containerized environments with shared SSH access for inter-service communication. Once attackers obtain credentials, they can pivot freely.


    The timing matters too. Langflow adoption accelerated throughout 2025-2026 as enterprises accelerated LLM application development. Many deployments predated the security patch, leaving a wide window of vulnerability. Unlike traditional web applications, which tend to have established patching cadences, AI/ML infrastructure often operates outside formal change management processes, creating pockets of unpatched systems that persist for months.


    This is not merely a software vulnerability—it's a symptom of a maturity gap. Organizations deploying cutting-edge AI infrastructure often lack the operational discipline to treat these systems with the same security rigor as their traditional application stacks. Until that changes, Langflow and similar open-source AI frameworks will remain attractive beachheads for initial compromise.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)