Skip to content

Back to the catalog

Orca Security: Langflow RCE (CVE-2026-33017) Actively Exploited
orca.securityadvisory

Orca Security: Langflow RCE (CVE-2026-33017) Actively Exploited

Orca Security details CVE-2026-33017 (CVSS 9.8), an unauthenticated RCE in Langflow's public flow-build API (/api/v1/build_public_tmp/{flow_id}/flow) that lets attackers execute arbitrary Python via a crafted node definition, with no sandboxing. Trend Micro observed active exploitation within 20 hours of disclosure, deploying a Go-based "lambsys" binary that kills rival cryptominers, disables AppArmor/SELinux/UFW/iptables, wipes logs, harvests credentials/.env files, and installs a geo-aware XMRig miner; ~7,000 internet-exposed Langflow instances were found, the flaw is in CISA's KEV catalog, and fix guidance clarifies 1.8.2 is still vulnerable — users must upgrade to 1.9.0+ or the 1.9.0.dev18 nightly and rotate exposed secrets.

TL;DR Unauthenticated RCE in Langflow (CVE-2026-33017) is being actively exploited to deploy the "lambsys" cryptomining malware; 1.8.2 is still vulnerable — patch to 1.9.0+.
Open original ↗

Organisations named here

  • 83.142.209.214

CVEs named here

  • CVE-2026-33017

Technologies named here

  • Langflow
  • Orca Security Platform
  • Python
  • Go
  • CISA KEV
  • Trend Micro

Techniques named here

  • Security control evasion
  • Rival malware removal
  • Credential and secret harvesting
  • Lateral movement using harvested SSH keys

Threat actors named here

  • lambsys
  • XMRig

Related in AppSec