Active Exploitation
#threatreport #MediumCompleteness
Compromised in 34 Minutes: A Real-World Exploitation Record of Langflow CVE-2026-9198 | 26-08-2026
Source: http://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247520008&idx=1&sn=0d6eb1521de256b16f73fcbc62d833e4
Key details below ↓
💀Threats:
Xmrig_miner, Adaptixc2_tool, Mirai,
🎯Victims: Langflow instances, Honeypot hosts
🔓CVEs: CVE-2026-9198 \[[Vulners](https://vulners.com/cve/CVE-2026-9198)]
- CVSS V3.1: *9.8*,
- Vulners: Exploitation: True
Soft:
- langflow (<1.10.1)
CVE-2026-9103 \[[Vulners](https://vulners.com/cve/CVE-2026-9103)]
- CVSS V3.1: *9.8*,
- Vulners: Exploitation: Unknown
Soft:
- langflow (<1.10.1)
CVE-2026-8481 \[[Vulners](https://vulners.com/cve/CVE-2026-8481)]
- CVSS V3.1: *9.9*,
- Vulners: Exploitation: Unknown
Soft:
- langflow (<1.10.1)
📚TTPs:
⚔️Tactics: 9
🛠️Technics: 19
🧨IOCs:
- IP: 1
- Hash: 8
💽Software: Langflow, angflow AP, Langflow A, OpenAI, angflow ex, Linux, Unix, curl
🪙Crypto: monero
🔢Algorithms: sha256
🔠Functions: exec
📜Programming Languages: python
💻Platforms: x86, cross-platform, arm, amd64, mips
#threatreport:
The report documents real-world exploitation of Langflow CVE-2026-9198 against Internet-exposed, default-configured instances. Honeypot telemetry recorded attackers reaching vulnerable API endpoints within approximately 34 minutes of exposure. The primary exploitation path used `/api/v1/validate/code` to trigger command execution. Observed processes included `sh -c /tmp/abc&`, running as the `www-data` user, while payloads were downloaded with `wget` and created or moved using `gnucp`. Attackers assessed three hosts within 37 minutes before selecting one for deployment.
Multiple payload types were observed. One intrusion installed a customized AdaptixC2 Gopher implant capable of remote command execution, file operations, process enumeration, and screen capture. Another deployed XMRig 6.22.2 for Monero mining, accompanied by a Python watchdog that restarted the miner every 10 seconds. The miner repeatedly ran as `www-data` and communicated with a mining pool. Its rig name incorporated an `lf9` prefix and the victim address, linking the activity to Langflow exploitation. A separate XMRig 6.26.0 loader supported Linux x86-64, ARM64, and FreeBSD amd64, used TLS, deleted its executable after launch, and lacked embedded wallet or pool configuration.
The activity also included a Mirai-like botnet payload. Attackers tried x86, ARMv7, and MIPS variants before successfully deploying an i386 binary disguised as `/tmp/klogd`. The malware used HTTP and a custom command protocol, and demonstrated self-propagation behavior. Some attackers instead abused `auto_login` to obtain a `SUPERUSER` token and directly request `/api/v1/flows`, exposing credentials stored in flow-definition JSON without invoking `validate/code`. The report identifies both automated and targeted activity, including repeated fixed commands and rapid multi-host payload delivery.
Affected organizations should upgrade to Langflow 1.10.1 or later, rebuild container images, disable auto-login, restrict access through authentication controls or VPN, and run the service with minimal privileges. Investigations should review logs for `auto_login` followed by `validate/code` or full-data flow requests, rotate exposed credentials, and inspect for suspicious child processes and deleted-but-still-running executables using process or kernel telemetry.
Post summary
The report documents real‑world exploitation of Langflow CVE‑2026‑9198, provides detailed attack mechanics and recommended mitigations, and shows active use in the wild.
