# Langflow CVE-2026-33017 Unauthenticated RCE Actively Exploited for Monero Mining (lambsys)

> Langflow versions prior to 1.9.0 contain a critical unauthenticated remote code execution vulnerability (CVE-2026-33017, CVSS 9.3) in the /api/v1/build_public_tmp endpoint. The endpoint accepts attacker-controlled flow data containing arbitrary Python code, which is executed via exec() with zero sandboxing. Active exploitation since March 20, 2026 delivers the lambsys Monero miner binary via XMRig, propagates via SSH credential reuse, and targets exposed Langflow AI pipelines.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-07-23T19:50:09.718Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1002
- **ID:** TL-2026-1002
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33017

## Description

CVE-2026-33017 is a critical code injection vulnerability affecting Langflow AI orchestration platform (versions < 1.9.0 / < 1.8.2). The vulnerability exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is intentionally unauthenticated to support public flow building. However, the endpoint incorrectly accepts an optional 'data' parameter containing attacker-controlled flow definitions. These flow definitions contain node objects with arbitrary Python code that bypass authentication and are passed directly to Python's exec() function with no sandboxing, code inspection, or validation. This enables single-line remote code execution payloads.

Attackers exploit this by: (1) discovering exposed Langflow instances via internet scanning; (2) constructing a JSON payload with malicious node code; (3) sending a POST request to the vulnerable endpoint; (4) achieving immediate code execution in the context of the Langflow process. Trend Micro researchers (Simon Dulude, John Zhang) documented active in-the-wild exploitation between March 27 and April 15, 2026. Attackers deliver the lambsys malware family, a multi-stage downloader that fetches and executes XMRig Monero miner binaries, maintains persistence via SSH key reuse, and propagates laterally to other systems on compromised networks.

The attack chain: CVE-2026-33017 RCE → curl/wget lambsys binary from C2 (83.142.209.214:80) → XMRig Monero mining daemon spawned → SSH scanning and brute-force using stolen/weak credentials → lateral movement and persistence. Infrastructure includes at minimum the C2 server at 83.142.209.214:80 coordinating malware distribution and mining pool communication. CISA added CVE-2026-33017 to the Known Exploited Vulnerabilities catalog on 2026-03-25, 5 days after publication, with an action due date of 2026-04-08.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1110 Brute Force
- T1552 Unsecured Credentials
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1020 Automated Exfiltration
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1499 Endpoint Denial of Service
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1555 Credentials from Password Stores
- T1057 Process Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1489 Service Stop

## Sources

- [NIST NVD: CVE-2026-33017](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33017)
- [GitHub Security Advisory GHSA-rvqx-wpfh-mfx7](https://github.com/advisories/GHSA-rvqx-wpfh-mfx7)
- [Langflow Security Advisory GHSA-vwmf-pq79-vjvx](https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx)
- [Langflow Release 1.8.2 / 1.9.0 (Security Patch)](https://github.com/langflow-ai/langflow/releases/tag/1.8.2)
- [CISA Known Exploited Vulnerabilities - CVE-2026-33017](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017)
- [Sysdig Threat Research: CVE-2026-33017 Exploitation Timeline and Detection](https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours)
- [The Hacker News: Langflow RCE Exploited to Deploy Monero Miners](https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html)
- [Exploit Analysis: CVE-2026-33017 Langflow RCE (Medium writeup)](https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896)
- [Trend Micro Research: Lambsys Monero Mining Campaign Analysis](https://www.trendmicro.com/en_us/research/threat-intelligence/lambsys-monero-mining.html)
- [GitHub Langflow Repository Commit 73b6612e3ef25fdae0a752d75b0fabd47328d4f0 (Fix)](https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1002