Langflow CVE-2026-33017 Exploited to Steal AWS Keys, Deploy NATS Worker

Gbhackers •Mayura Kathir • May 14, 2026

Langflow instances left unpatched against CVE-2026-33017 are now being actively abused not just for remote code execution, but as launchpads to steal AWS keys and join a NATS-backed botnet-style worker pool dubbed “KeyHunter.” The vulnerability, now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, affects Langflow public flow-building endpoint and allows arbitrary Python execution without […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Langflow CVE-2026-33017 Exploited for AWS Key Theft and Botnet Deployment The Langflow vulnerability CVE-2026-33017 is being actively exploited to steal AWS keys and create a botnet known as 'KeyHunter.' This vulnerability allows for remote code execution on unpatched Langflow instances, particularly affecting public flow-building endpoints. Attackers are leveraging this flaw to turn compromised systems into workers for a NATS-based botnet, facilitating large-scale credential theft and misuse of cloud resources. The CVE was published on March 20, 2026, and added to CISA's Known Exploited Vulnerabilities catalog shortly after on March 25, 2026. Security researchers have highlighted the urgency for organizations to patch their Langflow instances to prevent exploitation. 3 sources 73

Extracted Entities

Langflow CVE-2026-33017 Exploited to Steal AWS Keys, Deploy NATS Worker

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)