Attackers are actively exploiting a critical Langflow bug to drop Monero miners on exposed AI infrastructure. The vulnerability — CVE-2026-33017 — carries a CVSS score of 9.3. That’s about as bad as it gets.
Trend Micro spotted the campaign running between March 27 and April 15. The attack chain is brutally simple. A single line of Python code sent to an unauthenticated Langflow API endpoint triggers a shell script that downloads a miner binary and launches it. No login needed.
The miner, called “lambsys,” is a Go binary that does its job with ruthless efficiency. It kills competing miners from Kinsing, WatchDog, Rocke, and Outlaw. Deletes their wallets and keys. Disables AppArmor, UFW, iptables, SELinux, and the kernel NMI watchdog. Even kills the Alibaba Cloud Aliyun agent if it’s there.
Then it establishes cron persistence and beacons home to 83.142.209[.]214:80. It grabs the host’s public IP and location from ipinfo.io — partly to pick the nearest mining pool for better hash rates, partly to geo-fence victims in certain regions.
The SSH key propagation is what makes this nasty. The malware spreads to every SSH-reachable host the victim can authenticate to. One exposed Langflow instance becomes a highway into the rest of the network.
Trend Micro noted that an earlier version of the same binary was compiled in May 2024. The operators have been iterating for over two years, dodging AV tools the whole time.
This isn’t the first time Langflow has been hit. CVE-2025-3248 (CVSS 9.8) was abused last June to distribute the Flodrix botnet. Another unpatched flaw, CVE-2026-5027, was disclosed last month.
The takeaway? Exposed AI app endpoints are a growing attack surface. Cryptominers don’t care about your cool machine learning pipeline — they just want your GPU cycles.
