Active Exploitation
#threatreport #MediumCompleteness
Compromised in 34 Minutes: A Real-World Exploitation Record of Langflow CVE-2026-9198 | 26-08-2026
Source: http://mp.weixin.qq.com/s?__biz=MzI2MDc2MDA4OA==&mid=2247520008&idx=1&sn=0d6eb1521de256b16f73fcbc62d833e4
Key details below ↓
💀Threats:
Xmrig_miner, Adaptixc2_tool, Mirai,
🎯Victims: Langflow instances, Honeypot hosts
🔓CVEs: CVE-2026-9198 \[[Vulners](https://vulners.com/cve/CVE-2026-9198)]
- CVSS V3.1: *9.8*,
- Vulners: Exploitation: True
Soft:
- langflow (<1.10.1)
CVE-2026-9103 \[[Vulners](https://vulners.com/cve/CVE-2026-9103)]
- CVSS V3.1: *9.8*,
- Vulners: Exploitation: Unknown
Soft:
- langflow (<1.10.1)
CVE-2026-8481 \[[Vulners](https://vulners.com/cve/CVE-2026-8481)]
- CVSS V3.1: *9.9*,
- Vulners: Exploitation: Unknown
Soft:
- langflow (<1.10.1)
📚TTPs:
⚔️Tactics: 9
🛠️Technics: 19
🧨IOCs:
- IP: 1
- Hash: 8
💽Software: Langflow, angflow AP, Langflow A, OpenAI, angflow ex, Linux, Unix, curl
🪙Crypto: monero
🔢Algorithms: sha256
🔠Functions: exec
📜Programming Languages: python
💻Platforms: x86, cross-platform, arm, amd64, mips
#threatreport:
The report documents real-world exploitation of Langflow CVE-2026-9198 against Internet-exposed, default-configured instances. Honeypot telemetry recorded attackers reaching vulnerable API endpoints within approximately 34 minutes of exposure. The primary exploitation path used `/api/v1/validate/code` to trigger command execution. Observed processes included `sh -c /tmp/abc&`, running as the `www-data` user, while payloads were downloaded with `wget` and created or moved using `gnucp`. Attackers assessed three hosts within 37 minutes before selecting one for deployment.
Multiple payload types were observed. One intrusion installed a customized AdaptixC2 Gopher implant capable of remote command execution, file operations, process enumeration, and screen capture. Another deployed XMRig 6.22.2 for Monero mining, accompanied by a Python watchdog that restarted the miner every 10 seconds. The miner repeatedly ran as `www-data` and communicated with a mining pool. Its rig name incorporated an `lf9` prefix and the victim address, linking the activity to Langflow exploitation. A separate XMRig 6.26.0 loader supported Linux x86-64, ARM64, and FreeBSD amd64, used TLS, deleted its executable after launch, and lacked embedded wallet or pool configuration.
The activity also included a Mirai-like botnet payload. Attackers tried x86, ARMv7, and MIPS variants before successfully deploying an i386 binary disguised as `/tmp/klogd`. The malware used HTTP and a custom command protocol, and demonstrated self-propagation behavior. Some attackers instead abused `auto_login` to obtain a `SUPERUSER` token and directly request `/api/v1/flows`, exposing credentials stored in flow-definition JSON without invoking `validate/code`. The report identifies both automated and targeted activity, including repeated fixed commands and rapid multi-host payload delivery.
Affected organizations should upgrade to Langflow 1.10.1 or later, rebuild container images, disable auto-login, restrict access through authentication controls or VPN, and run the service with minimal privileges. Investigations should review logs for `auto_login` followed by `validate/code` or full-data flow requests, rotate exposed credentials, and inspect for suspicious child processes and deleted-but-still-running executables using process or kernel telemetry.
Post summary
The report confirms real‑world exploitation of Langflow CVE‑2026‑9198 via `/api/v1/validate/code`, with attackers deploying mining and botnet payloads; a patch to version 1.10.1 is advised.
