Vulnerabilities · 76 days ago

Exposed Langflow Apps Become Network Pivots

An exposed Langflow endpoint can hand an attacker code execution and then become a bridge into the rest of the network. The standard response of patching the app misses the real break: the attacker can reuse the victim’s own SSH trust to move past the original host.

Researchers said active attacks are using CVE-2026-33017, an unauthenticated RCE in Langflow, to run a one-line Python payload that pulls down a shell script, starts a Monero miner, and disables competing miners and security controls. The campaign was observed over 19 days and also spreads to other SSH-reachable systems through reused keys.

That makes an internet-facing AI workflow service more than a single-host exposure. If SSH trust is already present, one compromised Langflow instance can become a wider pivot point for commodity cryptomining and lateral spread.

CVE-2026-33017

NVD KEV

Known exploited · CISA KEV

CISA federal remediation date Apr 8 · date passed

Timeline

Jun 30 Reported by The Hacker News
Apr 8 CISA federal deadline for CVE-2026-33017 passed
Mar 25 CVE-2026-33017 added to CISA KEV

Sources

1 source covering this story

The Hacker News Jun 30
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
CVE-2026-33017 lets attackers abuse an unauthenticated Langflow API endpoint, run Lambsys, and spread via reused SSH keys.

Entities

CVE-2026-33017

Part of the PlainSec briefing for 2026-07-01

Editions

Vulnerabilities · 76 days agoExposed Langflow Apps Become Network PivotsAn exposed Langflow endpoint can hand an attacker code execution and then become a bridge into the rest of the network. The standard response of patching the app misses the real break: the attacker can reuse the victim’s own SSH trust to move past the original host.Researchers said active attacks are using CVE-2026-33017, an unauthenticated RCE in Langflow, to run a one-line Python payload that pulls down a shell script, starts a Monero miner, and disables competing miners and security controls. The campaign was observed over 19 days and also spreads to other SSH-reachable systems through reused keys.That makes an internet-facing AI workflow service more than a single-host exposure. If SSH trust is already present, one compromised Langflow instance can become a wider pivot point for commodity cryptomining and lateral spread.