NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Langflow public-flow flaw CVE-2026-33017 exploited for credential theft and cryptocurrency mining

Attackers exploited Langflow’s AI workflow builder to run code without logging in, harvest credentials and install cryptocurrency miners. Version 1.8.2 remained vulnerable; 1.9.0 fixes this flaw. Ask your IT team to update and check exposed servers.

What to do

If your business or family office runs Langflow, ask its IT team to install the latest stable release; 1.9.0 is the minimum fix for this flaw. Have them check any previously internet-accessible server for compromise and rotate exposed API keys, database passwords and cloud credentials.

What’s happening

CVE-2026-33017 affects Langflow, a visual tool for building AI agents and workflows. Its public-flow feature accepted supplied code and ran it with the server application’s permissions, allowing remote attackers to access files and credentials without logging in. Langflow’s current advisory lists versions through 1.8.2 as affected and 1.9.0 onwards as fixed. Sysdig observed exploitation on 18 March, including credential harvesting against its decoy servers, and CISA listed the flaw on 25 March. JFrog then confirmed that 1.8.2 was still vulnerable despite earlier claims that it was patched: the effective fix was initially available only in a nightly build. Stable 1.9.0 reached GitHub and PyPI on 14 April. Later reporting described cryptocurrency-mining attacks continuing into April. A software fix is available; the reviewed sources do not establish that exploitation has ended.

What
Flaw
Affects
Langflow AI workflow builder
Affected
Langflow <= 1.8.2
Fixed in
Langflow >= 1.9.0
CVE
CVE-2026-33017
Since
16 Mar 2026
Closed
30 June 2026

Timeline

  1. Wider attacks

    The Hacker News reported Trend Micro’s findings of Monero-mining attacks exploiting this flaw between 27 March and 15 April. The malware also attempted to spread to other computers using SSH keys.

  2. New fixFixed

    Langflow released stable version 1.9.0, the version its advisory identifies as fixing this flaw. The package was also published on PyPI that day.

  3. Fix incompletePartly fixed

    JFrog confirmed that 1.8.2 remained vulnerable in both Python packages and official Docker images, despite earlier fix claims. The fix worked in a nightly build, but stable 1.9.0 was still unreleased.

  4. CISA added

    CISA added CVE-2026-33017 to its Known Exploited Vulnerabilities catalogue, with an 8 April remediation deadline for US federal civilian agencies.

  5. Wider attacks

    Sysdig observed the first exploitation attempt against its decoy servers, followed by credential harvesting later that day. It recorded attacks from six source IP addresses within 48 hours of disclosure.

  6. Made public

    Langflow’s advisory disclosed unauthenticated code execution through public flow building. GitHub dates publication to 16 March; Sysdig’s subsequent report gives 17 March.

Sources

  1. Unauthenticated Remote Code Execution in Langflow via Public Flow Build EndpointLangflow · 16 Mar 2026
  2. CVE-2026-33017: How attackers compromised Langflow AI pipelines in 20 hoursSysdig · 19 Mar 2026
  3. Known Exploited Vulnerabilities catalogue — CVE-2026-33017CISA · 3 Nov 2026
  4. Langflow CVE-2026-33017: Latest 'fixed' version is still exploitableJFrog · 26 Mar 2026
  5. Langflow 1.9.0 releaseLangflow · 14 Apr 2026
  6. langflow 1.9.0 — release files and publication datePyPI · 14 Apr 2026
  7. Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App EndpointsThe Hacker News · 30 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS