Langflow RCE Vulnerability Leads to Monero Cryptominer Deployment

Thehackernews

Langflow RCE Vulnerability Leads to Monero Cryptominer Deployment

First seen 30 Jun 2026, 17:15 UTC • •73.5

Article Content

1 / 3

Browse articles

ThreatCluster •July 1, 2026 at 16:37 UTC

•CVE-2026-33017 is a critical RCE vulnerability in Langflow being actively exploited.
•Attackers are deploying Monero cryptominers on compromised AI application servers.
•Organizations should urgently assess their Langflow installations for exposure.

Threat actors are exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow, to compromise exposed AI application servers. This exploitation allows attackers to deploy a customized Monero (XMR) cryptominer silently. The vulnerability was published on March 20, 2026, and has been actively exploited since March 25, 2026. Trend Micro researchers Simon Dulude and John Zhang documented the campaign, indicating a shift in cryptominer delivery tactics. Organizations running Langflow should assess their exposure and implement necessary security measures. The current status of the exploitation is ongoing, with significant risk to internet-exposed AI systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 100d ago How this analysis works

Timeline

2026-03-20

CVE-2026-33017 published

Langflow's critical RCE vulnerability was officially disclosed, affecting exposed AI servers.

2026-03-21

First public PoC released

A proof of concept for CVE-2026-33017 was made public, increasing the risk of exploitation.

2026-03-25

CVE-2026-33017 added to CISA KEV

CISA confirmed active exploitation of the vulnerability, prompting alerts to organizations.

Recent

Active exploitation reported

Trend Micro researchers documented ongoing attacks leveraging the Langflow RCE vulnerability.

More articles in this cluster (2)

Threat Graph

3 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-33017

Relationships

CVE-2026-33017 related to Malware
CVE-2026-33017 related to T1190 - Exploit Public-Facing Application

Following this threat?

Track CVE-2026-33017 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…