Langflow CVE-2025-3248 Unauthenticated RCE Exploited to Build Custom Gafgyt/BASHLITE DDoS Botnet

Langflow CVE-2025-3248 Unauthenticated RCE Exploited to (TL-2026-1328), also tracked as Langflow Gafgyt DDoS Campaign, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-14. It has no confirmed attribution, affects langflow-ai Langflow, references 1 CVE (CVE-2025-3248), maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1059.004), and is covered by 9 detection rules and 17 indicators of compromise.

Key facts for TL-2026-1328

Threat ID
TL-2026-1328
Also known as
Langflow Gafgyt DDoS Campaign
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-14
Last reviewed
2026-07-14
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, infrastructure, government administration, critical infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
17

Malware and tooling in Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

Malware and tooling: Gafgyt/BASHLITE

Attackers are actively exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow's /api/v1/validate/code endpoint, to deploy a stripped-down Gafgyt/BASHLITE variant purpose-built for DDoS flooding. The malware uses a custom-modified RC4 cipher for C2 communications and omits cryptomining or persistence, focusing solely on UDP/TCP flood, connection exhaustion, and random-payload attacks.

How Langflow CVE-2025-3248 Unauthenticated RCE Exploited to works

CVE-2025-3248 is a critical (CVSS 3.1: 9.8) code-injection / missing-authentication vulnerability in Langflow, an open-source visual builder for AI agents and workflows (langflow-ai/langflow), affecting all versions prior to 1.3.0. The vulnerability lives in the /api/v1/validate/code endpoint, which accepts a raw "code" string and passes it into Python's exec() without authentication or sandboxing. Because Python decorator expressions and default-argument expressions are evaluated at function-definition time (before the function body ever runs), an attacker can smuggle a call such as @exec("__import__('os').system('...')") or def foo(cmd=exec("...")) into the submitted code and achieve immediate, unauthenticated remote code execution as the Langflow server process. Horizon3.ai privately reported the flaw on 2025-02-22; Langflow shipped a fix on 2025-03-31 (v1.3.0), CVE-2025-3248 was assigned 2025-04-03, and a third-party PoC was published 2025-04-09, at which point exploitation accelerated. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2025-05-05 with a 2025-05-26 remediation due date, and the flaw has since been tied to multiple in-the-wild campaigns, including delivery of the Flodrix botnet (Trend Micro, mid-2025) and, per Sysdig, the first documented agentic-AI-operated ransomware/extortion campaign ("JADEPUFFER"). On 2026-07-14 Akamai's Security Intelligence Group published telemetry showing yet another campaign abusing the same unauthenticated endpoint: attackers POST a payload that shells out via os.system() to wget a Linux x86_64 ELF binary (bot.x86_64) from a staging server at 184.174.96.191:8088, chmod it executable, and launch it from /tmp/bot_x86_64. The dropped binary is a heavily stripped Gafgyt/BASHLITE-lineage DDoS bot: it daemonizes via clone(), detaches from its controlling terminal, closes stdio, and prints the ASCII taunt "come at me krebs rimasuta go BRRT" before beaconing out. Unlike full-featured Gafgyt/Mirai forks, this variant carries no cryptominer and no persistence mechanism (no cron/init/service installation) — it exists purely to receive attack commands and flood. Command-and-control runs over TCP port 1337 using a custom-modified RC4 stream cipher: the key-scheduling algorithm seeds its S-box with a nonstandard arithmetic sequence (S[i] = (0x0D + i * 0xA7) mod 256) instead of the canonical 0..255 identity fill, mixes in two hardcoded 32-bit constants (0xDEADBEEF, 0xCAFEBABE) across five passes of a Borland-style linear congruential generator, and further scrambles PRGA keystream bytes with rolling ROL/SHR bit-shift operations and a rolling counter — a deliberate attempt to defeat generic RC4 traffic-decryption tooling built for stock Gafgyt samples. Once connected, the bot accepts single-byte attack-state commands selecting one of four flood modes: UDP flood (0x01, high-volume sendto loops), TCP flood (0x02, SYN/ACK spam), HOLD flood (0x03, keep-alive connection exhaustion), and Junk/STD flood (0x04, random-payload UDP intended to exhaust firewall/NAT state tables). The reuse of the same unauthenticated /api/v1/validate/code primitive across at least three independent, differently-motivated campaigns (Flodrix botnet, JADEPUFFER agentic ransomware, and this Gafgyt/BASHLITE DDoS variant) underscores that internet-exposed Langflow instances remain a high-value, trivially exploitable initial-access foothold for both commodity botnet operators and more sophisticated actors.

MITRE ATT&CK techniques used in TL-2026-1328

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Execution

T1059.004 Unix Shell; T1059.006 Python

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1498 Network Denial of Service; T1498.001 Direct Network Flood

Resource Development

T1583.001 Domains; T1588.001 Malware; T1588.005 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

  • langflow-ai — Langflow
    Vulnerable versions: < 1.3.0
    Fixed in: 1.3.0; 1.3.0+

Remediation for Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

Patches

  • Langflow 1.3.0 (patch PR langflow-ai/langflow#6911)

Immediate actions

  • Upgrade Langflow to version 1.3.0 or later, which removes the unauthenticated code-execution path in /api/v1/validate/code
  • Block outbound connections to 184.174.96.191 (TCP/8088 staging, TCP/1337 C2) at perimeter firewalls and egress proxies
  • Restrict or remove public internet exposure of Langflow's management/API interface; place it behind a VPN, reverse proxy with auth, or SSO gateway
  • Hunt for the file bot.x86_64 / path /tmp/bot_x86_64 and the SHA256 e00d92ca28a2cfd75e96f71fc0408747f04942657fcab0f2a25ce79bc3ad23a8 across Langflow hosts

Workarounds

  • If patching is not immediately possible, disable or firewall the /api/v1/validate/code and /api/v1/build_public_tmp endpoints at a reverse proxy
  • Isolate Langflow instances on a segmented network with no direct internet exposure

Longer-term hardening

  • Deploy EDR/behavioral monitoring on Langflow hosts to flag processes spawned from /tmp that close stdio and daemonize via clone()
  • Set LANGFLOW_AUTO_LOGIN=false and run the Langflow service as a non-root, least-privilege user
  • Implement network egress allow-listing for AI/ML workflow servers, which routinely have no legitimate need for arbitrary outbound wget/curl to unknown IPs
  • Add detection content for non-standard-port (1337) outbound TCP with high-entropy payloads consistent with custom-RC4 C2

CVEs associated with Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

CVE-2025-3248

Weaknesses (CWE) in Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

CWE-94, CWE-306

Timeline of Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

  • Horizon3.ai privately reports the Langflow /api/v1/validate/code unauthenticated code-execution flaw to the Langflow maintainers.
  • Langflow maintainers create the fix pull request (#6911) closing the exec() code-validation gap.
  • Langflow 1.3.0 is released, removing the unauthenticated code-execution path in /api/v1/validate/code.
  • CVE-2025-3248 is officially assigned to the Langflow code-injection vulnerability.
  • Horizon3.ai and third parties publish full technical details and proof-of-concept exploit code, accelerating in-the-wild scanning and exploitation.
  • CISA adds CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, setting a remediation due date of 2025-05-26 for federal agencies.
  • Recorded Future/GreyNoise report 361 distinct malicious IPs actively scanning for and exploiting CVE-2025-3248 across the US, Australia, Singapore, Germany, and Mexico, against a population of roughly 1,050 Shodan-exposed Langflow instances.
  • Trend Micro documents active exploitation of CVE-2025-3248 to deliver the Flodrix botnet.
  • Sysdig/SecurityWeek report the first documented agentic-AI-operated ransomware/extortion campaign (dubbed JADEPUFFER) abusing the same Langflow RCE.
  • Akamai Security Intelligence Group publishes telemetry showing CVE-2025-3248 exploited to drop a custom, stripped-down Gafgyt/BASHLITE DDoS-only variant with a modified RC4 C2 cipher.

Sources cited for Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

Threats related to Langflow CVE-2025-3248 Unauthenticated RCE Exploited to

Detection coverage for TL-2026-1328

As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1328 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats