Langflow RCE Flaw Exploited Within Hours to Deploy Cryptominer and SSH Worm on AI Servers

A critical unauthenticated remote code execution vulnerability in Langflow, the open-source visual framework widely used to build AI agent workflows, is being actively exploited in a cryptocurrency mining campaign that silently installs a Monero miner on internet-exposed AI servers. The flaw, tracked as CVE-2026-33017, was documented by Trend Micro's TrendAI Research team and carries a CVSS 4.0 score of 9.3. Exploitation in the wild began within 20 hours of public disclosure, a window that left almost no practical time for organisations to patch before active attacks commenced.

The Vulnerability

CVE-2026-33017 resides in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which accepts an attacker-controlled code field and evaluates it directly as Python within the server's process context, with no authentication required. The risk is compounded by the fact that Langflow ships with AUTO_LOGIN enabled by default, which grants any unauthenticated visitor a superuser token and the ability to create a public flow on demand, effectively removing the authentication barrier that would otherwise limit exploitation to legitimate users. This is the second time within a year that Langflow has shipped a vulnerability of this exact class. CVE-2025-3248, disclosed in 2025, was exploited by the Flodrix DDoS botnet using an identical exploitation primitive. Organisations running Langflow that did not fully remediate the earlier flaw should treat that history as a strong signal that the underlying architectural pattern, accepting and executing attacker-supplied code through an unauthenticated endpoint, requires structural review rather than a single point patch.

How the Attack Chain Works

Exploitation begins with a single line of injected Python that fetches and executes a bash dropper script from attacker infrastructure. The dropper creates a hidden persistence directory, downloads the core malware binary, and launches it in the background. Critically, the dropper also functions as an SSH-key-reuse worm: it enumerates the compromised host's known_hosts file and active SSH agent sockets to propagate laterally to every SSH-reachable host, including systems with no outbound internet access, by pushing the payload via SCP rather than requiring the target to pull it from the internet directly. This SSH propagation mechanism means a single internet-exposed Langflow instance can become the entry point for compromising an entire internal network of servers that were never themselves directly exposed.

The core payload is a UPX-packed Go binary whose earliest known variant predates this specific campaign by 22 months, indicating a mature, actively maintained malware family rather than a newly developed tool. The 2026 build is 48 per cent smaller than its predecessor, with VirusTotal detection dropping from 31 out of 66 engines to just 4 out of 66, reflecting deliberate and ongoing evasion engineering by the operator. Upon execution, the malware terminates 39 rival cryptominer processes by name, including known Kinsing, WatchDog, and Outlaw variants, and kills any process bound to common mining pool ports, a competitive behaviour that confirms the operator is actively defending exclusive control of compromised resources against other criminal groups.

The malware then systematically dismantles host defences, disabling AppArmor, SELinux, UFW, iptables, the kernel NMI watchdog, and notably Alibaba Cloud's Aliyun security agent specifically, indicating deliberate targeting of cloud-hosted AI infrastructure across multiple cloud platforms. It deletes system logs to erase forensic evidence and installs dual persistence mechanisms through a cron job and a separate bash watchdog loop. After establishing control, the malware downloads and verifies a customised XMRig cryptocurrency mining build, extracting it into a hidden directory specifically designed to evade casual inspection. The miner connects to its mining pool using a spoofed user-agent string designed to blend into legitimate system monitoring traffic, and queries geolocation services to exclude victims in the operator's own jurisdiction, a deliberate technique to avoid domestic law enforcement exposure that is consistent with patterns observed across multiple cybercriminal operations this year.

GCC Relevance

Langflow and similar visual AI agent-building frameworks have seen rapid adoption across GCC enterprises building internal AI tooling, automation pipelines, and customer-facing AI products, often deployed quickly by development teams without the same security review applied to traditional production infrastructure. The SSH-key-reuse worm component is the most consequential risk for GCC enterprise environments specifically: a single Langflow instance exposed to the internet for development or testing purposes can become the pivot point for compromising production systems elsewhere in the network, even systems that were never themselves intended to be internet-facing. This pattern connects directly to the supply chain and developer-tooling risk theme documented in our earlier coverage of credential-stealing campaigns targeting development environments.

As with the identity and access management research published this month, non-human identities and machine credentials, including SSH keys used for automated deployment and inter-server communication, are governed far less rigorously across most enterprise environments than human user accounts, making them a consistently attractive target for this class of worm-style propagation. For GCC enterprises running cloud-hosted AI infrastructure, the deliberate disabling of cloud-native security agents, specifically Alibaba Cloud's Aliyun agent in this case, is a signal that operators are actively researching and targeting the specific defensive tooling deployed across major cloud platforms used in the region. Organisations should not assume that standard cloud security agent deployment alone is sufficient protection against this class of threat.

Mandatory Remediation

Organisations running Langflow should update to version 1.9.0 or later immediately, restrict public internet access to all Langflow instances regardless of whether they are intended for development or production use, explicitly set AUTO_LOGIN to false, and audit whether the Langflow service is running under a privileged account that could expand the impact of any future exploitation. The command-and-control IP address associated with this campaign appears on the Spamhaus DROP blocklist, meaning organisations already enforcing that feed at their egress firewall would block every beacon attempt from this specific campaign without needing any campaign-specific indicator. Verifying that Spamhaus DROP enforcement is active at the network perimeter is a fast, low-effort step that provides immediate protection against this and similar campaigns using infrastructure that overlaps with known malicious hosting ranges.

Any organisation that discovers indicators of this malware family should treat the incident as a full SSH key exposure event rather than a single-host compromise. All SSH keys present on the affected host must be rotated, and every system reachable via those keys must be investigated for lateral movement, regardless of whether that system shows direct signs of compromise. Given the worm's demonstrated ability to reach hosts with no outbound internet access via SCP push, network segmentation alone does not guarantee a system was unreachable by this propagation method.