Executive Summary
Attackers exploit Langflow unauthenticated RCE CVE-2026-33017 (CVSS 9.3) to deploy Monero miners on exposed AI app endpoints.
What Happened
Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 (CVSS score: 9.3), an unauthenticated remote code execution (RCE) vulnerability in Langflow, indicating threat actors are scanning and targeting exposed artificial intelligence (AI)
Affected Products
- Langflow
Vulnerability / Attack Technique
AI workflow RCE for crypto mining
Technical Mechanism
Unauthenticated code execution.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Exposed AI apps are scanned at scale.
Recommended Controls
- Update Langflow
- Restrict exposure
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.