Langflow CVE Critical RCE Deploys Monero Miner on AI Endpoints

On June 30, 2026, Trend Micro published a technical report confirming that threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow. The flaw carries a CVSS score of 9.3. Consequently, attackers have been using it to deploy a custom Monero cryptocurrency miner on exposed AI application endpoints. The campaign illustrates how commodity cryptojacking operators are pivoting toward AI infrastructure as a new entry vector into enterprise networks.

What Happened: Langflow CVE-2026-33017 Cryptominer Campaign Targets AI Endpoints

CVE-2026-33017 is an unauthenticated RCE vulnerability in Langflow, a popular open-source framework for building AI-powered applications. Trend Micro researchers observed active exploitation between March 27 and April 15, 2026. During this window, threat actors used a single line of Python code injected through an unauthenticated Langflow API endpoint to pull down a shell script, fetch a miner binary, and launch it as a detached process.

The campaign is notable for its speed and sophistication. The malware terminates competing miners, disables host-level security controls, establishes persistence through cron jobs, and spreads laterally via reused SSH keys. Furthermore, the threat actors behind the operation have been iterating on the malware family for over two years, indicating a mature and adaptive operation.

Technical Details of the Langflow RCE Exploit

The attack begins with exploitation of CVE-2026-33017, which allows an unauthenticated attacker to execute arbitrary Python code through a Langflow API endpoint. This initial access is then leveraged to run a remotely hosted shell script that serves as a dropper for the main payload.

The dropper checks for a running process named lambsys. If absent, it downloads the binary using curl or wget and launches it as a detached process. The binary itself is an ELF executable written in Go. It carries out the following actions:

• Disables security controls: AppArmor, Ubuntu UFW, iptables, SELinux, kernel NMI watchdog, and Alibaba Cloud Aliyun agent
• Terminates rival miners: Processes associated with Kinsing, WatchDog, Rocke, and Outlaw
• Deletes competing wallets and keys: Removes rival cryptocurrency material
• Establishes cron-based persistence
• Removes system logs to cover tracks
• Manipulates file attributes: Removes and reapplies immutable attributes on critical system files
• Spreads via SSH keys: Propagates to all reachable hosts using existing SSH credentials
• Fetches a custom XMRig miner from a remote server
• Beacons to an external server at 83.142.209[.]214:80

The malware also contacts ipinfo.io to obtain the host’s public IP address and location. This allows the operators to select geographically nearby mining pools for optimal hash rates. It also enables geo-fencing, giving attackers a way to exclude victims in certain regions.

Notably, the malware executes its attack logic through a cascade of short-lived shell subprocesses rather than direct Go functions. Therefore, if one of 51 parallel pkill commands fails, the failure is contained. The other 50 carry on. This design trades stealth for reliability.

Business and Operational Impact

Langflow is widely used by developers and enterprises to build AI-powered workflows and applications. An exposed Langflow instance can become a gateway for broader network compromise. The impact categories include:

• Unauthorized compute consumption: CPU and GPU resources are hijacked for cryptocurrency mining, degrading legitimate workloads
• Lateral movement: SSH key propagation turns one compromised endpoint into a pathway to the entire infrastructure
• Security control neutralization: Firewalls, AppArmor, and SELinux are disabled, leaving the host unprotected
• Data integrity risk: System logs are wiped, hampering forensic investigation
• Reputational damage: Organizations running AI infrastructure face scrutiny if found to be serving as cryptominer platforms

The trend is clear. AI application endpoints are becoming a favored target for commodity malware operators. This campaign follows a similar pattern to CVE-2025-3248, another critical Langflow flaw exploited in June 2025 to distribute the Flodrix botnet malware.

Mitigation and Recommendations

Defenders running Langflow instances must act immediately. The vulnerability is unauthenticated, the exploit is simple, and the malware is actively spreading.

Immediate Actions for Defenders

1. Patch immediately. Upgrade Langflow to the latest patched version. CVE-2026-33017 allows unauthenticated RCE, making it one of the highest-priority patches for any AI infrastructure.
2. Remove public exposure. Do not leave Langflow API endpoints accessible from the internet. Place them behind VPNs, reverse proxies, or zero-trust access controls.
3. Audit for compromise. Check running processes for lambsys, examine cron entries, review SSH authorized_keys, and look for immutable attribute changes on system files.
4. Rotate SSH keys. If an exposed Langflow instance had access to SSH keys, rotate them immediately across all reachable hosts.
5. Restore security controls. Re-enable AppArmor, SELinux, iptables, and UFW on affected systems. Verify Aliyun agent integrity if running in Alibaba Cloud.
6. Monitor for lateral movement. Review network logs for connections to 83.142.209[.]214 and ipinfo.io from AI infrastructure segments.
7. Review AI endpoint inventory. Identify all Langflow and similar AI framework deployments in your environment. Many may be shadow IT.

Long-Term Strategy

Furthermore, organizations should treat AI application infrastructure as a critical asset class requiring the same hardening as production web applications. Exposed AI endpoints are no longer a niche risk. They are a front door for malware operators who understand their value.

Bottom line: If you run Langflow, patch now, take it off the public internet, and assume any exposed instance is already compromised until proven otherwise.

Incident Summary

CVE ID / Incident:	CVE-2026-33017 (NVD)
Affected Systems:	Langflow open-source AI application framework (exposed API endpoints)
Disclosure Date:	June 30, 2026 (Trend Micro report)
Attack Window:	March 27 – April 15, 2026 (observed)
Patch Status:	Available — upgrade to latest Langflow version
Exploitation:	Confirmed in the wild (Trend Micro observed active campaign)
Malware Family:	Lambsys (Go ELF binary), XMRig miner
Lateral Movement:	SSH key propagation to reachable hosts
Historical Context:	Follows CVE-2025-3248 (June 2025), another critical Langflow flaw exploited for Flodrix botnet distribution

References

1. Trend Micro, “Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints,” The Hacker News, June 30, 2026, https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html, accessed June 30, 2026.
2. Trend Micro Research, Technical Report: CVE-2026-33017 Active Exploitation Campaign, published last week (June 2026).
3. NVD, “CVE-2026-33017 Detail,” National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2026-33017, accessed June 30, 2026.
4. NVD, “CVE-2025-3248 Detail,” National Vulnerability Database, https://nvd.nist.gov/vuln/detail/CVE-2025-3248, accessed June 30, 2026.