Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
Summary: Threat actors exploited CVE-2026-33017, an unauthenticated remote code execution flaw in Langflow with a CVSS score of 9.3, to deploy a Monero cryptocurrency miner over a 19-day window between March 27 and April 15, 2026. The malware, a Go-written ELF binary called "lambsys," disables host security controls including AppArmor, iptables, SELinux and Alibaba Cloud's Aliyun agent, removes system logs, kills competing miners from Kinsing, WatchDog, Rocke and Outlaw, and spreads through reused SSH keys.
What's compelling: Trend Micro notes an artifact from the prior iteration of this binary was compiled in May 2024, meaning the operators have spent over two years refining a tool that turns one exposed Langflow endpoint into SSH-reachable access across your estate.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-33017
- Related
- CVE-2026-33017: Langflow Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2026