2026-06-28
HighVendor postCVE-2026-33017 (CVSS 9.3): Threat actors exploited an unauthenticated Langflow RCE flaw to deploy a Monero miner, disable AppArmor, establish persistence, and spread via SSH. Trend Micro research.
What happened
Attacker sends a single unauthenticated HTTP request to a Langflow API endpoint that evaluates Python code. The request contains one line of Python that fetches a remote shell script, which downloads the lambsys miner binary via curl or wget, launches it as a detached process, and initiates SSH-based lateral movement to connected hosts.
Why it matters
Full RCE on Langflow servers. The lambsys malware terminates competing crypto miners (Kinsing, WatchDog, Rocke, Outlaw), disables AppArmor and Ubuntu Uncomplicated Firewall, establishes cron-based persistence, beacons to attacker infrastructure, and spreads to every SSH-reachable host the Langflow server can authenticate to. All LLM API keys, agent workflow credentials, and downstream service access held by the compromised instance are exposed.
Missing authorization check
The Python code evaluation endpoint must require authentication before accepting user-supplied code for execution. No internet-exposed endpoint should evaluate arbitrary code without validating the caller's identity and scope. Runtime isolation should prevent code execution from reaching the host OS layer.
Would PP block it?
The attack bypasses the agent layer entirely — it exploits a bare API endpoint on the Langflow server. PP's authorization chain is external to the Langflow runtime and cannot intercept this request. Once the attacker achieves RCE on the Langflow server, they can read PP-bound credentials and potentially impersonate agent sessions. Full protection requires hardening the Langflow server (authentication on all code-execution endpoints, runtime isolation) as a prerequisite. PP receipts for downstream agent actions remain valid as a downstream audit control but cannot prevent the initial server compromise.
Incident analysis
2026-03-27
Exploitation campaign begins. Threat actors start scanning for internet-exposed Langflow instances vulnerable to CVE-2026-33017 and deploying the lambsys Monero miner.
2026-04-15
Active exploitation campaign ends (last observed activity). Over 19 days, attackers compromised multiple Langflow servers and propagated via SSH to connected hosts.
2026-06-25
Trend Micro researchers Simon Dulude and John Zhang publish full technical analysis of the CVE-2026-33017 cryptomining campaign, including malware binary analysis and C2 infrastructure details.
2026-06-28
GBHackers and CyberPress report Trend Micro findings. Security community identifies second major Langflow RCE campaign in 2026 following CVE-2026-5027 path traversal.
2026-06-30
The Hacker News and SC World report; pattern of serial Langflow CVE exploitation by threat actors targeting AI agent infrastructure is publicly documented.
Authorization boundary
This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.
CVE-2026-33017 is a pre-agent exploit: the attacker reaches the Langflow server directly via a vulnerable unauthenticated endpoint before any agent session begins. PP's Runtime Gate enforces authorization on agent-issued actions but cannot gate unauthenticated HTTP requests to vulnerable API endpoints.
Related incidents and controls
CVE-2026-5027 (CVSS 8.8): Langflow Path Traversal Allowed Unauthenticated Arbitrary File Write and RCE Across 7,000 Exposed AI Agent Pipelines
Microsoft Defender: Mage AI and MCP servers deployed without auth in the wild, enabling RCE with cluster-admin access
CISA KEV: CVE-2026-42271 in LiteLLM — authenticated command injection via MCP test endpoints, chains to unauthenticated RCE (CVSS 10.0)
Start small
This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.