An exposed Langflow endpoint can hand an attacker code execution and then become a bridge into the rest of the network. The standard response of patching the app misses the real break: the attacker can reuse the victim’s own SSH trust to move past the original host.
Researchers said active attacks are using CVE-2026-33017, an unauthenticated RCE in Langflow, to run a one-line Python payload that pulls down a shell script, starts a Monero miner, and disables competing miners and security controls. The campaign was observed over 19 days and also spreads to other SSH-reachable systems through reused keys.
That makes an internet-facing AI workflow service more than a single-host exposure. If SSH trust is already present, one compromised Langflow instance can become a wider pivot point for commodity cryptomining and lateral spread.