Langflow Flaw CVE-2026-33017 Used to Deliver Linux Cryptominer

Jun 23, 2026 · Original article ↗

Summary

Trend Micro analyzed a campaign exploiting unauthenticated Langflow RCE to deploy a Monero miner, disable Linux security controls, establish persistence, and spread using SSH keys. It recommends updating Langflow and restricting public access.

Key points

The campaign exploited CVE-2026-33017 through an unauthenticated Langflow API endpoint to execute attacker-supplied Python code.
The dropper downloaded the lambsys Go binary, which deployed a customized XMRig-based Monero miner.
The malware disabled host security controls, removed rival miners, deleted syslog, and established cron- and script-based persistence.
The dropper searched SSH keys, known_hosts entries, and agent sockets to spread to other reachable systems.
Researchers tracked activity from one seed IP over 19 days and linked tool behavior to a maintained malware family, while describing its lineage as a hypothesis.
Organizations should update Langflow to version 1.9.0 or later, restrict public access, review privileges, and investigate for compromise and exposed SSH keys.

Article Details

Attack Vectors: Unauthenticated exploitation of CVE-2026-33017 through Langflow's POST /api/v1/build_public_tmp/{flow_id}/flow endpoint executes attacker-supplied Python in the service process context.
Langflow's default AUTO_LOGIN behavior provides unauthenticated visitors with a superuser token and the ability to create the public flow required by the exploit.
Injected Python invokes curl or wget to retrieve isp.sh and pipe it into a shell. The dropper downloads and launches lambsys.
isp.sh spreads through SSH using accessible private keys and ssh-agent credentials, with targets obtained from known_hosts. It supports both remote downloading and SCP delivery.
lambsys installs cron and background-loop watchdogs that restore the payload if its process or binary is missing.
The authors hypothesize technique inheritance from the publicly available KORKERDS/MALXMR playbook, rather than establish direct descent or attribution to its operators.
Defensive Notes: Update Langflow to version 1.9.0 or later, restrict public access, and review whether the service has unnecessary privileges.
The article identifies a remediation introduced in 1.9.0.dev8 that prevents public flows from accepting attacker-controlled data and logs submission attempts.
Review exploitation logs for the reused flow ID 0ee284cc-0eb1-493f-bc60-94fa8d1cfd18 and the combination of rotating reconnaissance User-Agents followed by python-requests/2.25.1 exploitation requests. The User-Agent alone is not malicious.
Treat discovered lambsys artifacts as a potential SSH-key-exposure incident: rotate exposed keys and investigate systems reachable through the compromised account.
Monitor both TCP/8080 payload staging and TCP/80 runtime beacons; rules restricted to port 8080 miss post-deployment C2 traffic.
The authors report that enforcing the Spamhaus DROP feed at the egress firewall would block this operation's C2 beacons.
Hunt for /var/tmp/.xlamb/, /var/tmp/init_rmount, unauthorized cron watchdogs, security-control disablement, syslog deletion, and immutable attributes applied to /tmp and /var/tmp.
A userdel akay command outside an authorized response procedure can indicate competing cryptominer activity.
Do not rely solely on process-name checks: the dropper's pgrep -f lambsys check can produce false positives, whereas the binary's pgrep -x lambsys.elf check is more specific.
The article's ATT&CK table states that miner execution was not observed in the sandbox; current and older variants download an archive with the same hardcoded MD5.

Indicators of compromise

Type	Indicator	Context
IPV4	`83[.]142[.]209[.]214`	Observed Langflow exploitation source and current lambsys payload-staging and C2 server.
IPV4	`94[.]156[.]64[.]241`	C2 server used by the older 2024 lambsys variant.
MD5	`46096a72d84db5f1dafd944fcf6571c8`	Hardcoded integrity checksum for the malicious ks.tar miner archive shared by the 2024 and 2026 variants.