CVE-2026-33017Active Exploitation(langflow / langflow)

Exposed attacker infrastructure combining #Hermes Agent, #CyberStrikeAI, #SliverC2, and multiple LLMs used for automated CVE targeting, exploit validation, Telegram-based orchestration, and post-exploitation validation workflows. Opendir: 142.171.160[.]137:8888 VULN-MONITOR: 142.171.149[.169:8001 - Real-time 1day/0day RCE tracking across 18 sources🤔 CyberStrikeAI Server: 100.81.245[.29:8080 Chain: FOFA/Shodan recon → AI-assisted target filtering → CVE/PoC enrichment → custom scanner & exploit generation → exploit validation → WebSocket/shell access → post-exploitation environment validation → Telegram-pushed operations. Targeted CVEs: CVE-2026-0300 (Palo Alto PAN-OS) CVE-2024-21762 (FortiOS/FortiProxy SSL-VPN) CVE-2026-33017 (Langflow) CVE-2026-21858 (n8n) CVE-2026-3055 (Citrix ADC/NetScaler) CVE-2026-34486 (Apache Tomcat) CVE-2026-25253 (OpenClaw/Moltbot/Clawdbot) @malwrhunterteam @500mk500 @1ZRR4H @MichalKoczwara

Langflow just got hit with CVE-2026-33017. CVSS 9.3. Actively exploited to drop Monero miners on exposed endpoints. Same week: 282 iOS AI apps transmitting LLM API keys in cleartext. Anyone intercepting that traffic gets full backend access. Ade's response was two words: "Latch fixes this." He's right. But the more interesting signal came a day earlier. SCALE, Rialo's multi-agent coordination framework, is being integrated directly into Latch. That's a meaningful architectural expansion. Latch launched as access control for individual agents: what a single agent can touch, under what policy, on which machine. SCALE integration makes multi-agent coordination a first-class primitive inside that same framework. The difference matters. A single agent with bad access control is a security problem. A network of agents coordinating tasks with no verifiable handoff between them, no enforceable terms on delegated work, no accountability for what each agent did or didn't complete, is a systemic problem. @RialoHQ is building toward the latter before it becomes the dominant failure mode. The Langflow exploit and the cleartext API key pattern aren't edge cases. They're what happens when AI tooling gets deployed before anyone thought seriously about the security model. SCALE inside Latch means the coordination layer and the governance layer ship together rather than the governance being retrofitted after something goes wrong. That sequencing is rare and it's the right call.

الحمد لله خبر يسعدني مشاركته 🙏🏻 مشروعي prompt-injection-auditor أصبح مدرجاً في CVEFeed بجانب الثغرة الحرجة CVE-2026-33017 (درجة 9.8 - تحت الإستغلال النشط) 🔥🔥 https://cvefeed.io/vuln/detail/CVE-2026-33017 والأجمل: المشروع مرتبط الآن بـ 4 ثغرات CVE في قاعدتهم - الباحثون عن أي منها يجدون أداة الدفاع في طريقهم والتقييم هناك 4.9/5 من المجتمع ⭐ http://github.com/screem500/prompt-injection-auditor #الامن_السيبراني #CyberSecurity #CVE #AISecurity

🚨Alert🚨 CVE-2026-33017 : An Unauthenticated Remote Code Execution (RCE) Vulnerability in Langflow. 📊 2.0M Services are found on the http://hunter.how yearly. 🧐PoC : https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22Langflow%22 HUNTER : http://product.name="Langflow" 📰Refer:https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896 https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours #hunterhow #infosec #infosecurity #OSINT #Vulnerability

⚠️ Langflow CVE-2026-33017 was exploited in 20 hours of disclosure. An exposed API runs attacker-supplied Python with no auth, enabling full server takeover. Real attacks show credential theft, file access, and staged payload delivery. 🔗 Read → https://thehackernews.com/2026/03/critical-langflow-flaw-cve-2026-33017.html

🚨 CVE-2026-33017 is being exploited against Langflow. Attackers abuse an unauthenticated API endpoint to run Python code, drop Lambsys, and launch a Monero miner. Lambsys can spread via reused SSH keys. Langflow attack chain: https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html

Patch_Diffs -> New_Bugs Langflow, an open-source tool for visually building AI agent and RAG pipelines, is another example of multiple hits by the same flaw. CVE-2025-3248: user input to exec() CVE-2026-33017: same sink, diff endpoint 1. Grep the sink, not the CVE grep -rn "exec(compiled_code" src/ 2. Find every caller of the sink grep -rln "instantiate_class" src/ 3. Map callers to HTTP endpoints grep -B15 "async def.*flow" http://chat.py Patched once, vulnerable twice.

Langflow is one unauthenticated request away from a reverse shell. CVE-2026-33017: /api/v1/build_public_tmp/{flow_id}/flow accepts attacker-controlled flow definitions and runs them via exec() with no sandbox. Working reverse-shell PoC is public. Exposed instances are critical risk. https://github.com/z4yd3/PoC-CVE-2026-33017 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AgentSecurity #RCE

Rapid reaction gets you ahead. 4 days before CISA added CVE-2026-33017 (Langflow RCE) to KEV, watchTowr clients were already aware of their exposure. Reach out via our website (http://watchTowr.com) if you need support. https://t.co/Vzx6SGim0U

🛡️ We added Langflow code injection vulnerability CVE-2026-33017 to our Known Exploited Vulnerabilities Catalog. Visit https://go.dhs.gov/Z3Q for more information. #Cybersecurity #InfoSec https://t.co/DfWhyalMME

‼️ One POST to RCE: Unauthenticated Code Execution in Langflow (CVE-2026-33017) https://darkwebinformer.com/one-post-to-rce-unauthenticated-code-execution-in-langflow-cve-2026-33017/

⚡️ 0-Day Alert: IBM LangFlow OSS RCE LangFlow agent orchestration deployments have been under active exploitation since May. CVE-2025-34291: CORS misconfiguration + SameSite=None CVE-2026-33017*: Unauthenticated RCE via build_public_tmp's data parameter CVE-2026-55255: IDOR in /api/v1/responses: run any user's flow by ID CVE-2026-0770: Unauthenticated RCE via validate_code() / decorator abuse CVE-2026-9198: Unauthenticated RCE via auto_login + validate/code chain Bugs are not hard, likely spotted by generally available AI. Public exploit POCs exist. Majority takes input from an API endpoint variable and executes it directly on the OS. Attack pattern suggests that LangFlow has not seen basic security QA from the developer, and shouldn't be deployed in environments where arbitrary code execution poses a risk. * Attached: 33017 patch diff and code trace to exec()

CVE-2026-33017 - Langflow Unauthenticated RCE Langflow is a tool for building and deploying AI agents and MCP servers. https://github.com/MaxMnMl/langflow-CVE-2026-33017-poc #redteam #ai #cybersecurity

Langflow Got Hacked Twice Through the Same exec() Call - CVE-2026-33017 (CVSS 9.3) exploited in 20 hours with no public PoC https://blog.barrack.ai/langflow-exec-rce-cve-2026-33017/

Code review case study: finding CVE-2026-33017 in Langflow https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896

🚨 Less than a day after the disclosure of CVE-2026-33017, a critical unauthenticated RCE in Langflow, attackers were already exploiting it in the wild. Read the full breakdown👇 https://okt.to/LJ1HQr https://t.co/KCHNHlTtwo

‼️ CISA has added 1 vulnerability to the KEV Catalog. CVE-2026-33017: Langflow Code Injection Vulnerability https://darkwebinformer.com/cisa-kev-catalog/

Langflow's public flow endpoint passes user-supplied Python directly to exec() with zero sandboxing. Attackers exploited it in 20 hours. This is the second time the same exec() call was the root cause. https://blog.barrack.ai/langflow-exec-rce-cve-2026-33017/

⚠️⚠️ CVE-2026-33017 (CVSS 9.3): Unauth RCE in Langflow public flow builds. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJMT0dTUEFDRS1MYW5nRmxvdyI= 🎯3K+ results last year. FOFA Query: app="LOGSPACE-LangFlow" 🔖Refer: https://github.com/advisories/GHSA-vwmf-pq79-vjvx #OSINT #FOFA #CyberSecurity #Vulnerability https://t.co/GGTtujFrIR

CVE-2026-33017 (CVSS 9.8) is a critical, unauthenticated remote code execution vulnerability in Langflow that lets a single POST request execute arbitrary Python code. Our latest blog post shows how to detect exploitation with Wazuh. Read on: https://ow.ly/ini850ZBZkm