Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Langflow CVE-2026-33017 exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 50
3 unique sources, 3 articles

Summary

Hide ▲

CVE-2026-33017 in Langflow was disclosed on March 17, 2026 as an unauthenticated RCE with CVSS 9.3, allowing arbitrary Python execution from a single HTTP request with no credentials. By March 20, Sysdig said attackers had already built working exploits from the advisory, scanned exposed instances, and stolen databases, API keys, cloud credentials, and configuration files. CISA later said the flaw was actively exploited in Langflow 1.8.1 and earlier and told federal agencies to patch or stop using the product by April 8. Trend Micro then reported a March 27-April 15, 2026 campaign that used the same flaw to drop lambsys and XMRig, kill competing miners, and persist through cron and SSH.

Cases

Langflow unauthenticated RCE exploitation and secret theft (2)

Related Happenings

Lambsys custom XMRig miner activity on SSH-reachable hosts

Malware Activity
H score34 First: 30.06.2026 18:47 Last: 30.06.2026 18:47 Sources 1

How related: Subsequently, it downloads the binary on the machine using curl or wget, launches it as a detached process, and spreads itself to every SSH-reachable host the victim can authenticate to.

About this happening: The lambsys malware is now being used to deploy a custom XMRig miner and spread to SSH-reachable hosts, turning compromised systems into persistent cryptomining infras...

Open Happening

Palo Alto Networks GlobalProtect log search guidance for CVE-2026-0257

Advisory/Mitigation
H score35 First: 15.06.2026 09:17 Last: 15.06.2026 09:17 Sources 1

About this happening: Palo Alto Networks is urging GlobalProtect customers to search logs for successful gateway-connected events tied to CVE-2026-0257, a step that can expose possible unau...

Open Happening

Langflow security patch release for CVE-2026-5027

Security Patch Release
H score38 First: 11.06.2026 00:23 Last: 11.06.2026 00:23 Sources 1

About this happening: Langflow shipped fixes for CVE-2026-5027, closing a path traversal flaw that let attackers write arbitrary files on exposed servers. The patch landed in langflow-bas...

Open Happening

Langflow path traversal flaw (CVE-2026-5027)

Vulnerability
H score33 First: 10.06.2026 18:00 Last: 10.06.2026 18:00 Sources 1

About this happening: Langflow's CVE-2026-5027 is an unpatched path traversal vulnerability that is being actively exploited in the wild. The flaw lets an attacker write files to arbitr...

Open Happening

AI-driven worm reasons at runtime and self-replicates across a 33-host test network

Technical Analysis
H score40 First: 09.06.2026 14:59 Last: 09.06.2026 14:59 Sources 1

About this happening: Researchers demonstrated a proof-of-concept AI-driven worm that reasons at runtime and self-replicates, showing adaptive host-to-host spread across a 33-host vulnerable te...

Open Happening

Timeline

  1. 20.03.2026 12:20 1 articles · 3mo ago

    March 17 advisory discloses CVE-2026-33017 in Langflow

    Initial Disclosure

    A March 17 advisory disclosed CVE-2026-33017 in Langflow, an unauthenticated remote code execution flaw with CVSS 9.3 that lets attackers execute arbitrary Python code on exposed instances with a single HTTP request and no credentials.

    Show sources
    Open in new tab
  2. 20.03.2026 12:20 4 articles · 3mo ago

    Observed exploit activity against exposed Langflow instances

    Exploitation Observed

    Sysdig reported on March 20 that honeypots saw threat actors build working exploits directly from the advisory description, scan exposed Langflow instances from four source IPs using the same payload, and use custom Python exploit scripts delivered via a stage-2 dropper to harvest databases, API keys, cloud credentials, and configuration files.

    Show sources
    Open in new tab