# Langflow CVE-2025-3248 Unauthenticated RCE Exploited to Build Custom Gafgyt/BASHLITE DDoS Botnet

> Attackers are actively exploiting CVE-2025-3248, an unauthenticated remote code execution flaw in Langflow's /api/v1/validate/code endpoint, to deploy a stripped-down Gafgyt/BASHLITE variant purpose-built for DDoS flooding. The malware uses a custom-modified RC4 cipher for C2 communications and omits cryptomining or persistence, focusing solely on UDP/TCP flood, connection exhaustion, and random-payload attacks.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1328
- **ID:** TL-2026-1328
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-3248

## Description

CVE-2025-3248 is a critical (CVSS 3.1: 9.8) code-injection / missing-authentication vulnerability in Langflow, an open-source visual builder for AI agents and workflows (langflow-ai/langflow), affecting all versions prior to 1.3.0. The vulnerability lives in the /api/v1/validate/code endpoint, which accepts a raw "code" string and passes it into Python's exec() without authentication or sandboxing. Because Python decorator expressions and default-argument expressions are evaluated at function-definition time (before the function body ever runs), an attacker can smuggle a call such as @exec("__import__('os').system('...')") or def foo(cmd=exec("...")) into the submitted code and achieve immediate, unauthenticated remote code execution as the Langflow server process. Horizon3.ai privately reported the flaw on 2025-02-22; Langflow shipped a fix on 2025-03-31 (v1.3.0), CVE-2025-3248 was assigned 2025-04-03, and a third-party PoC was published 2025-04-09, at which point exploitation accelerated. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2025-05-05 with a 2025-05-26 remediation due date, and the flaw has since been tied to multiple in-the-wild campaigns, including delivery of the Flodrix botnet (Trend Micro, mid-2025) and, per Sysdig, the first documented agentic-AI-operated ransomware/extortion campaign ("JADEPUFFER"). On 2026-07-14 Akamai's Security Intelligence Group published telemetry showing yet another campaign abusing the same unauthenticated endpoint: attackers POST a payload that shells out via os.system() to wget a Linux x86_64 ELF binary (bot.x86_64) from a staging server at 184.174.96.191:8088, chmod it executable, and launch it from /tmp/bot_x86_64. The dropped binary is a heavily stripped Gafgyt/BASHLITE-lineage DDoS bot: it daemonizes via clone(), detaches from its controlling terminal, closes stdio, and prints the ASCII taunt "come at me krebs rimasuta go BRRT" before beaconing out. Unlike full-featured Gafgyt/Mirai forks, this variant carries no cryptominer and no persistence mechanism (no cron/init/service installation) — it exists purely to receive attack commands and flood. Command-and-control runs over TCP port 1337 using a custom-modified RC4 stream cipher: the key-scheduling algorithm seeds its S-box with a nonstandard arithmetic sequence (S[i] = (0x0D + i * 0xA7) mod 256) instead of the canonical 0..255 identity fill, mixes in two hardcoded 32-bit constants (0xDEADBEEF, 0xCAFEBABE) across five passes of a Borland-style linear congruential generator, and further scrambles PRGA keystream bytes with rolling ROL/SHR bit-shift operations and a rolling counter — a deliberate attempt to defeat generic RC4 traffic-decryption tooling built for stock Gafgyt samples. Once connected, the bot accepts single-byte attack-state commands selecting one of four flood modes: UDP flood (0x01, high-volume sendto loops), TCP flood (0x02, SYN/ACK spam), HOLD flood (0x03, keep-alive connection exhaustion), and Junk/STD flood (0x04, random-payload UDP intended to exhaust firewall/NAT state tables). The reuse of the same unauthenticated /api/v1/validate/code primitive across at least three independent, differently-motivated campaigns (Flodrix botnet, JADEPUFFER agentic ransomware, and this Gafgyt/BASHLITE DDoS variant) underscores that internet-exposed Langflow instances remain a high-value, trivially exploitable initial-access foothold for both commodity botnet operators and more sophisticated actors.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.006 Python
- T1036 Masquerading
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1571 Non-Standard Port
- T1498.001 Direct Network Flood
- T1498 Network Denial of Service
- T1595.002 Vulnerability Scanning
- T1583.001 Domains
- T1588.001 Malware
- T1588.005 Exploits
- T1027 Obfuscated Files or Information

## Sources

- [Langflow Exploited to Build Custom DDoS Gafgyt Botnets](https://www.akamai.com/blog/security-research/2026/jul/langflow-exploited-build-custom-ddos-gafgyt-botnets)
- [CVE-2025-3248 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-3248)
- [Unsafe at Any Speed: Abusing Python exec() for Unauth RCE in Langflow AI](https://www.horizon3.ai/attack-research/disclosures/unsafe-at-any-speed-abusing-python-exec-for-unauth-rce-in-langflow-ai/)
- [Critical Langflow Vulnerability (CVE-2025-3248) Actively Exploited to Deliver Flodrix Botnet](https://www.trendmicro.com/en_us/research/25/f/langflow-vulnerability-flodric-botnet.html)
- [Langflow: CVE-2025-3248: Active Exploitation](https://www.recordedfuture.com/blog/langflow-cve-2025-3248)
- [CVE-2025-3248 and CVE-2026-5027: Langflow RCE Vulnerabilities Explained](https://www.picussecurity.com/resource/blog/cve-2025-3248-cve-2026-5027-langflow-rce)
- [Agentic AI Used to Conduct Ransomware Attack via Langflow](https://www.securityweek.com/agentic-ai-used-to-conduct-ransomware-attack-via-langflow/)
- [CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV](https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html)
- [Known Exploited Vulnerabilities Catalog (CISA KEV) - CVE-2025-3248](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-3248)
- [CVE-2025-3248: Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code · Exploit & PoC](https://cve.imfht.com/detail/CVE-2025-3248?lang=en)
- [verylazytech/CVE-2025-3248 PoC](https://github.com/verylazytech/CVE-2025-3248)
- [Langflow 1.3.0 Release Notes (patch)](https://github.com/langflow-ai/langflow/releases/tag/1.3.0)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1328