Langflow RCE Vulnerability Exploited to Deploy Monero Cryptominer on Exposed AI Servers

Gbhackers •Divya • June 29, 2026

Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, to compromise internet-exposed AI application servers and silently deploy a customized Monero (XMR) cryptominer. Tracked and documented by Trend Micro researchers Simon Dulude and John Zhang, the campaign marks a significant pivot in commodity cryptominer delivery tactics, from traditional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Langflow RCE Vulnerability Leads to Monero Cryptominer Deployment Threat actors are exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow, to compromise exposed AI application servers. This exploitation allows attackers to deploy a customized Monero (XMR) cryptominer silently. The vulnerability was published on March 20, 2026, and has been actively exploited since March 25, 2026. Trend Micro researchers Simon Dulude and John Zhang documented the campaign, indicating a shift in cryptominer delivery tactics. Organizations running Langflow should assess their exposure and implement necessary security measures. The current status of the exploitation is ongoing, with significant risk to internet-exposed AI systems. 2 sources 74

Extracted Entities

Langflow RCE Vulnerability Exploited to Deploy Monero Cryptominer on Exposed AI Servers

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)