Critical Langflow RCE (CVSS 9.3) Actively Exploited to Hijack AI App Servers

If your company has built or deployed an AI-powered application this year, there is a good chance you are running, or have run, a tool called Langflow somewhere in your stack. A critical, actively exploited vulnerability in that platform is now being used by attackers to silently take over exposed servers, install cryptocurrency-mining malware, and spread to every other machine reachable through stolen SSH credentials. This is not a theoretical risk. It is happening right now, and the entry point is a web endpoint many companies do not realize is publicly accessible.

What was discovered

Security researchers at Trend Micro published a technical report detailing an active campaign exploiting CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow, a widely used low-code platform for building AI agents and automation workflows. The flaw carries a CVSS score of 9.3, placing it in the critical severity band.

The vulnerability allows an attacker to send a single line of Python code to an unauthenticated Langflow API endpoint. That code executes immediately on the server, with no login, no API key, and no user interaction required. In the observed campaign, that single line of code is enough to pull down a shell script, fetch a malicious binary, and launch a fully autonomous cryptojacking operation.

What makes this campaign especially aggressive is its sophistication. The malware does not simply install a miner and walk away. It actively hunts down and terminates rival cryptomining malware families already present on the host, including known strains like Kinsing, WatchDog, Rocke, and Outlaw. It deletes competing wallet and key material, disables host security controls such as firewalls and intrusion detection, and establishes persistence through scheduled cron jobs so it survives reboots.

Which systems are affected

Any internet-facing Langflow instance running a version vulnerable to CVE-2026-33017 is exposed. Langflow is used by companies of all sizes, including startups, agencies, and SMB development teams, to rapidly prototype and deploy AI-driven chatbots, workflow automations, and internal tooling. Because it is designed to be self-hosted and exposed via a web API so that other applications can call it, instances are frequently left reachable from the public internet, sometimes unintentionally.

The danger extends beyond the single compromised server. Once attackers gain a foothold, the malware actively scans for reused SSH keys and attempts to authenticate to every other host the compromised server's credentials can reach. In practice, this means one exposed AI prototype server, possibly spun up by a developer for a quick demo and forgotten, can become the doorway into a company's broader internal network, including production systems that were never directly exposed.

How attackers are exploiting it

The attack chain is efficient and largely automated, which is exactly why it scales so well against companies that are not actively monitoring their exposed assets.

• Scanning — Threat actors continuously scan the internet for exposed Langflow API endpoints, the same way attackers scan for any popular self-hosted web application.
• Initial execution — A crafted request triggers the unauthenticated code execution flaw, running an attacker-supplied Python snippet directly on the server.
• Dropper stage — That snippet downloads a shell script, which checks whether a malicious binary is already running, then fetches and launches a Go-based ELF executable as a detached background process.
• Defense evasion — The binary disables AppArmor, the Ubuntu firewall (UFW), iptables, SELinux, and even kernel-level watchdog protections, then wipes system logs to cover its tracks.
• Lateral movement — It attempts to authenticate over SSH to every host reachable using credentials and keys found on the compromised machine, spreading the infection sideways.
• Geo-aware payload delivery — The malware queries an IP geolocation service to choose the nearest mining pool and to exclude victims in certain regions, behavior consistent with a financially motivated, operationally mature group.
• Persistence — The malware sets the immutable file attribute on key system files such as crontab entries and SSH authorized_keys, making its changes resistant to removal even by an administrator with root access.

The attackers' goal in this campaign is cryptocurrency mining for direct financial gain, but the same unauthenticated RCE flaw could just as easily be used to steal data, deploy ransomware, or establish a long-term backdoor. Cryptojacking is frequently the canary in the coal mine. It tells you a server was compromised; it does not tell you that is the only thing that happened.

What is the real business impact

For a small or medium business, an incident like this carries costs well beyond a slower server.

According to IBM's Cost of a Data Breach Report, the global average cost of a data breach reached $4.88 million in the most recent reporting year, and businesses with fewer dedicated security resources consistently report longer detection and containment times, which directly drives up cost. Verizon's Data Breach Investigations Report has repeatedly found that exploitation of internet-facing vulnerabilities is one of the fastest-growing initial access vectors, precisely because automated scanning makes it cheap and scalable for attackers.

In this specific case, the business impact compounds in three ways:

• Direct resource theft — Cryptojacking malware consumes CPU and GPU resources around the clock, which on cloud infrastructure translates directly into inflated hosting bills, sometimes by thousands of dollars per month before anyone notices.
• Lateral compromise risk — Because the malware actively pivots via SSH, a single forgotten test server can expose production databases, internal admin panels, or customer data stores that were never meant to be reachable from that machine.
• Reputational and contractual exposure — If the compromised server stores or transits customer data, even cryptojacking-only incidents can trigger breach notification obligations depending on what else the attacker accessed once inside.

The most dangerous part of this threat is how invisible it is in its early stages. A server quietly mining cryptocurrency in the background does not crash, does not display a ransom note, and may run for weeks before anyone notices degraded performance or an unexpected cloud bill.

What you should do right now

• Identify every Langflow instance your company runs, including ones spun up for prototypes, hackathons, or proofs of concept that may have been forgotten.
• Patch immediately to the vendor-released fixed version that addresses CVE-2026-33017, or take unpatched instances offline until they can be updated.
• Remove public exposure of any AI application backend or API endpoint that does not need to be reachable from the open internet. Put it behind a VPN, IP allowlist, or authentication gateway.
• Rotate SSH keys across your infrastructure, especially keys that may be shared or reused across multiple servers, since lateral movement via SSH was a core part of this campaign.
• Audit cloud billing for anomalies. A sudden, unexplained spike in CPU usage or compute costs is one of the clearest signs of an active cryptojacking infection.
• Review crontab entries and file permissions on any server that has ever run Langflow or a similar AI tooling stack, looking for unfamiliar scheduled jobs or files with the immutable attribute set unexpectedly.

How Volturion helps

This kind of incident is exactly the failure mode Volturion is built to catch before attackers find it. Volturion continuously scans your company's public-facing domains, subdomains, and web applications for known, actively exploited vulnerabilities like CVE-2026-33017, flagging outdated or unpatched software the moment it is detected, mapped to severity, CWE, and OWASP category so your team understands the real risk without needing to be security experts.

Just as importantly, Volturion's continuous subdomain discovery automatically finds forgotten or shadow infrastructure, including test servers, internal tools, and prototype deployments that teams spin up and lose track of. These are precisely the kind of exposed endpoints that fueled this campaign. Volturion adds every newly discovered subdomain to ongoing monitoring automatically, so a forgotten AI prototype server does not become the open door an attacker walks through.

When a critical, actively exploited vulnerability like this one is detected on your assets, Volturion sends real-time alerts via email, Slack, Discord, or custom webhooks, and its AI-powered remediation engine generates specific, step-by-step fix instructions tailored to your exact tech stack, so your team can patch the exposure before it turns into a cryptojacking infection, a lateral breach, or worse.