Threat reportVulnerabilityTL-2026-1002
Langflow CVE-2026-33017 Unauthenticated RCE Actively Exploited for Monero Mining (lambsys)
Langflow CVE-2026-33017 Unauthenticated RCE Actively (TL-2026-1002), also tracked as GHSA-rvqx-wpfh-mfx7, is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-06-30 and last reviewed 2026-07-23. It has no confirmed attribution, affects Langflow Langflow, references 1 CVE (CVE-2026-33017), maps to 32 MITRE ATT&CK techniques (T1005, T1020, T1021), and is covered by 9 detection rules and 27 indicators of compromise.
- CVSS
- 9.3/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 32MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-1002
- Threat ID
- TL-2026-1002
- Also known as
- GHSA-rvqx-wpfh-mfx7, GHSA-vwmf-pq79-vjvx, Langflow Code Injection Vulnerability, Langflow Unauthenticated RCE
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, artificial-intelligence, cloud-computing, financial-services, research-and-development, data-analytics
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 27
- Updates
- 2026-07-23 · revalidated 1× · latest source
Malware and tooling in Langflow CVE-2026-33017 Unauthenticated RCE Actively
Malware and tooling: Monero Miner, lambsys, Custom C2 (HTTP-based), XMRig
How Langflow CVE-2026-33017 Unauthenticated RCE Actively works
Langflow versions prior to 1.9.0 contain a critical unauthenticated remote code execution vulnerability (CVE-2026-33017, CVSS 9.3) in the /api/v1/build_public_tmp endpoint. The endpoint accepts attacker-controlled flow data containing arbitrary Python code, which is executed via exec() with zero sandboxing. Active exploitation since March 20, 2026 delivers the lambsys Monero miner binary via XMRig, propagates via SSH credential reuse, and targets exposed Langflow AI pipelines.
CVE-2026-33017 is a critical code injection vulnerability affecting Langflow AI orchestration platform (versions < 1.9.0 / < 1.8.2). The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is intentionally unauthenticated to support public flow building. However, the endpoint incorrectly accepts an optional 'data' parameter containing attacker-controlled flow definitions. These flow definitions contain node objects with arbitrary Python code that bypass authentication and are passed directly to Python's exec() function with no sandboxing, code inspection, or validation. This enables single-line remote code execution payloads.
Attackers exploit this by: (1) discovering exposed Langflow instances via internet scanning; (2) constructing a JSON payload with malicious node code; (3) sending a POST request to the vulnerable endpoint; (4) achieving immediate code execution in the context of the Langflow process. Trend Micro researchers (Simon Dulude, John Zhang) documented active in-the-wild exploitation between March 27 and April 15, 2026. Attackers deliver the lambsys malware family, a multi-stage downloader that fetches and executes XMRig Monero miner binaries, maintains persistence via SSH key reuse, and propagates laterally to other systems on compromised networks.
The attack chain: CVE-2026-33017 RCE → curl/wget lambsys binary from C2 (83.142.209.214:80) → XMRig Monero mining daemon spawned → SSH scanning and brute-force using stolen/weak credentials → lateral movement and persistence. Infrastructure includes at minimum the C2 server at 83.142.209.214:80 coordinating malware distribution and mining pool communication. CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog on 2026-03-25, 5 days after publication, with an action due date of 2026-04-08.
MITRE ATT&CK techniques used in TL-2026-1002
Collection
exfiltration
Lateral Movement
T1021 Remote Services; T1550 Use Alternate Authentication Material
Defense Evasion
T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1098 Account Manipulation
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Credential Access
T1110 Brute Force; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1489 Service Stop; T1496 Resource Hijacking; T1499 Endpoint Denial of Service
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information; T1595 Active Scanning; T1598 Phishing for Information
defense-impairment
Affected products and versions in Langflow CVE-2026-33017 Unauthenticated RCE Actively
- Langflow — Langflow
Vulnerable versions: < 1.8.2; < 1.9.0
Fixed in: 1.9.0; 1.8.2
Remediation for Langflow CVE-2026-33017 Unauthenticated RCE Actively
Patches
- Langflow 1.9.0 or later (security patch GHSA-rvqx-wpfh-mfx7 and GHSA-vwmf-pq79-vjvx)
Immediate actions
- Upgrade Langflow to version 1.9.0 or later immediately
- If upgrade not possible, restrict network access to Langflow instances via firewall/VPN
- Block inbound connections to 83.142.209.214:80 and associated C2 infrastructure
- Monitor for suspicious process execution (exec() calls with user-supplied code)
- Kill any running XMRig or mining processes on affected systems
- Audit SSH access logs for lateral movement attempts
- Revoke or rotate SSH keys on compromised systems
Workarounds
- If immediate upgrade not possible: disable or restrict access to /api/v1/build_public_tmp endpoint via reverse proxy/WAF
- Implement strict egress filtering to block connections to known C2 infrastructure
- Deploy rate limiting on the vulnerable endpoint to slow exploitation attempts
Longer-term hardening
- Implement code sandboxing or allow-listing for node definitions in Langflow flows
- Deploy EDR/behavioral monitoring for crypto-mining indicators (XMRig binary fetches, high CPU/GPU utilization)
- Enforce network segmentation to limit lateral SSH propagation
- Implement input validation and deserialization hardening for all API endpoints
- Add authentication checks to the build_public_tmp endpoint or restrict to internal use only
- Deploy SIEM rules correlating exec() calls with external data sources (CWE-94/95 detection)
- Regular vulnerability scanning of all Langflow instances and versions
CVEs associated with Langflow CVE-2026-33017 Unauthenticated RCE Actively
Weaknesses (CWE) in Langflow CVE-2026-33017 Unauthenticated RCE Actively
Timeline of Langflow CVE-2026-33017 Unauthenticated RCE Actively
- JFrog Security Research discloses that Langflow 1.8.2, previously believed to be a fix, remains fully exploitable; only 1.9.0+ actually remediates CVE-2026-33017.
- Langflow 1.8.2 / 1.9.0 security patches released addressing CWE-94, CWE-95, CWE-306 code injection vulnerability
- CVE-2026-33017 published by GitHub Security Advisory (GHSA-rvqx-wpfh-mfx7, GHSA-vwmf-pq79-vjvx) with patch for Langflow
- Public proof-of-concept exploitation analysis published on Medium detailing the vulnerability mechanics and exploit chain
- CISA adds CVE-2026-33017 to Known Exploited Vulnerabilities (KEV) catalog (5 days after publication) with active exploitation status; action due date set to 2026-04-08
- Sysdig Threat Research publishes analysis of CVE-2026-33017 exploitation showing compromise within 20 hours of vulnerability disclosure
- Trend Micro researchers (Simon Dulude, John Zhang) document active in-the-wild exploitation commencing: attackers scanning for exposed Langflow instances and delivering lambsys Monero miner
- First public proof-of-concept exploit code for CVE-2026-33017 published on GitHub, followed by multiple independent PoC repositories.
- CISA action due date for remediation of CVE-2026-33017; organizations should have applied patches or mitigations by this date
- Trend Micro documents peak of lambsys Monero mining campaign (April 15, 2026 endpoint); hundreds of Langflow instances compromised across data analytics, AI, and research sectors
- CISA publishes Binding Operational Directive 26-04, revoking BOD 22-01's fixed KEV remediation deadlines in favor of a four-variable risk-based prioritization model, citing this case among its drivers.
- The Hacker News publishes report on ongoing exploitation of unpatched Langflow instances; campaign continues 100+ days after initial disclosure
- SecurityWeek publishes 'Is Patching Dead? Vulnerability Management in the Post-Mythos Era' (Danelle Au), using this threat as its central case study alongside Mandiant M-Trends 2026 and Verizon 2026 DBIR findings.
Update history for TL-2026-1002
- 2026-07-23 — Post-"Mythos" Vulnerability Management: AI-Accelerated Exploitation Outpaces Patch-Deadline Models (feat. CVE-2026-33017 Langflow 20-Hour Weaponization): What changed No severity/exploitability/status escalation (already CRITICAL/ACTIVE); patch guidance sharpened — Langflow 1.8.2 is confirmed NOT a fix (JFrog), only 1.9.0+ remediates. Public PoC exploit code is now available on GitHub (previ
Sources cited for Langflow CVE-2026-33017 Unauthenticated RCE Actively
- NIST NVD: CVE-2026-33017
- GitHub Security Advisory GHSA-rvqx-wpfh-mfx7
- Langflow Security Advisory GHSA-vwmf-pq79-vjvx
- Langflow Release 1.8.2 / 1.9.0 (Security Patch)
- CISA Known Exploited Vulnerabilities - CVE-2026-33017
- Sysdig Threat Research: CVE-2026-33017 Exploitation Timeline and Detection
- The Hacker News: Langflow RCE Exploited to Deploy Monero Miners
- Exploit Analysis: CVE-2026-33017 Langflow RCE (Medium writeup)
- Trend Micro Research: Lambsys Monero Mining Campaign Analysis
- GitHub Langflow Repository Commit 73b6612e3ef25fdae0a752d75b0fabd47328d4f0 (Fix)
Detection coverage for TL-2026-1002
As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1002 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.