Langflow CVE-2026

Cybersecuritynews •Tushar Subhra Dutta • May 14, 2026

Attackers are now abusing a fresh Langflow vulnerability to quietly steal cloud keys and turn victim systems into workers for a new NATS based botnet. This campaign shows how a single exposed AI workflow tool can become the start of large scale credential theft and cloud misuse. According to researchers, the operation centers on CVE-2026-33017, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Langflow CVE-2026-33017 Exploited for AWS Key Theft and Botnet Deployment The Langflow vulnerability CVE-2026-33017 is being actively exploited to steal AWS keys and create a botnet known as 'KeyHunter.' This vulnerability allows for remote code execution on unpatched Langflow instances, particularly affecting public flow-building endpoints. Attackers are leveraging this flaw to turn compromised systems into workers for a NATS-based botnet, facilitating large-scale credential theft and misuse of cloud resources. The CVE was published on March 20, 2026, and added to CISA's Known Exploited Vulnerabilities catalog shortly after on March 25, 2026. Security researchers have highlighted the urgency for organizations to patch their Langflow instances to prevent exploitation. 3 sources 73

Extracted Entities

Langflow CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Platforms (1)