Langflow RCE Vulnerability Leads to Monero Cryptominer Deployment

Threat actors are exploiting CVE-2026-33017, a critical unauthenticated remote code execution vulnerability in Langflow, to compromise exposed AI application servers. This exploitation allows attackers to deploy a customized Monero (XMR) cryptominer silently. The vulnerability was published on March 20, 2026, and has been actively exploited since March 25, 2026. Trend Micro researchers Simon Dulude and John Zhang documented the campaign, indicating a shift in cryptominer delivery tactics. Organizations running Langflow should assess their exposure and implement necessary security measures. The current status of the exploitation is ongoing, with significant risk to internet-exposed AI systems.

Key Points: • CVE-2026-33017 is a critical RCE vulnerability in Langflow being actively exploited. • Attackers are deploying Monero cryptominers on compromised AI application servers. • Organizations should urgently assess their Langflow installations for exposure.