Skip to content

Langflow CVE exploitation canary timeline: two attackers, two playbooks on the same AI-stack target (VulnCheck, Aug 2026)

Summary

VulnCheck's August 28, 2026 post "Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack" publishes canary (real-vulnerable-instance) telemetry on Langflow — the open-source AI agent/workflow platform (acquired by IBM via DataStax; 153,000+ GitHub stars at publication). Two durable readings:

  1. Langflow is now a standing exploitation target, not a one-off. Before 2026 there was only one Langflow vulnerability with in-the-wild exploitation evidence. In 2026 VulnCheck recorded 11 additional Langflow CVEs targeted and reported exploited — a total of 12 Langflow CVEs with observed exploitation.
  2. Two financially motivated attackers ran independent, divergent post-exploitation playbooks against the same technology in the same ~2-month window (April 22 – June 25, 2026), with VulnCheck counting 15,000+ successful canary attempts across three of the Langflow CVEs (CVE-2026-0769, CVE-2025-3248, CVE-2026-5027) and Target Intelligence showing hundreds of Langflow hosts still active and vulnerable on the public internet, highest concentration in the United States.

The canary data separates the two operators cleanly:

  • Attacker 1 — credential theft ("Grab the Creds and Run"). Initial access via CVE-2026-5027 (Upload path-traversal / arbitrary file write → RCE). Within two weeks: a Python credential harvester, proxy agents, and a SimpleHelp RAT installation. Harvester ran 20.49s and exfiltrated to http://23.234.98[.]182:9999; IRC C2 established to 185.117.74[.]172:6667 (port 6667) after SRE-style investigation. Persistence via cron: 0 * * * * /usr/bin/3WA72N.sh &. Window: May 12 – June 8, 2026.
  • Attacker 2 — cryptomining and lateral scanning ("Spin Up the Miners"). Initial access via CVE-2025-3248 (unauthenticated arbitrary code execution), with a /app/a territory marker. Then: proxy agent → Chisel SOCKS5 tunnel → pearl-miner XMR mining → auditd disabled (forensic blind spot, from June 10) → CVE-2026-0769 exploit dropping .sysd + .cache-sysd persistence copy + .watchdog.sh → PocSuite3 execution → SSH pivot to 216.78.235[.]34 to scan for more targets. Window: April 22 – June 25, 2026.

The two chains share the same target family but differ in entry CVE, objective (host credentials vs. miner expansion), C2 (IRC vs. SSH pivot), and post-exploitation kit — which is exactly why the durable tell is per-operator behavior, not "Langflow was hit."

The 2026 Langflow exploitation list (VulnCheck's tracked set)

CVE VulnCheck KEV CISA KEV CVSS Class
CVE-2025-3248 2025-04-12 2025-05-05 9.8 Missing authentication
CVE-2025-34291 2026-01-23 2026-05-21 9.4 Origin validation error
CVE-2026-0770 2026-02-14 2026-07-21 9.8 Inclusion of functionality from untrusted control sphere
CVE-2026-33017 2026-03-19 2026-03-25 9.3 Code injection
CVE-2026-21445 2026-04-09 — 8.8 Missing authentication for critical function
CVE-2026-5027 2026-06-08 — 8.8 Path traversal (restricted directory)
CVE-2026-0769 2026-06-24 — 9.8 Eval injection
CVE-2026-55255 2026-06-26 2026-07-07 8.4 Authorization bypass via user-controlled key
CVE-2024-37014 2026-08-01 — 9.8 Code injection (RCE)
CVE-2026-9198 2026-08-04 2026-08-04 9.8 Code injection (RCE)
CVE-2026-55450 2026-08-09 — 9.3 Sensitive-information exposure
CVE-2026-33497 2026-08-11 — 8.7 Path traversal (restricted directory)

Note: CVE-2026-9198 is the Langflow auto-login / token-minting RCE already tracked on the CISA KEV August 4 page; the CISA-KEV column here reflects VulnCheck's table as published August 28, 2026.

Why Langflow is a rich target (per VulnCheck)

  • Default-deployment model is internet-accessible. Langflow's first deployment model ships as a public service; its "shareable playground" exposes the project's MCP server to external users without installation or API keys — which raises the probability of internet exposure.
  • Security best practices exist but new adopters skip them.
  • High value by construction: Langflow-class deployments hold compute resources, keys to sensitive data, and adjacency to other high-value systems — "the exact type of system an attacker would find very valuable."
  • AI products are new and fast-adopted: they "can (and do) overlook security first principles."

Tags

Confidence and scope

  • The canary timelines, IP addresses, and tool names are VulnCheck's published observations against their own deployed canaries — real attacker behavior, but on canary infrastructure, not named victims.
  • The 15,000+ figure is VulnCheck's canary success count across the three named CVEs; it does not measure total internet-wide exploitation.
  • The "hundreds of active vulnerable hosts" figure is VulnCheck Target Intelligence exposure telemetry; it is not a victim count.
  • Neither attacker is attributed to a named actor. The two chains must not be merged with the JADEPUFFER agentic-ransomware operator (also entered via CVE-2025-3248), the CVE-2026-33017 cryptominer SSH-worm campaign, or any other Langflow campaign solely because they target the same product.

Detection and triage

  • Version inventory: confirm Langflow version, image digest, and deployment topology (default internet-accessible mode vs. restricted); CVE-2025-3248-era deployments without authentication are the highest-risk population.
  • Hunt Attacker-1 shape: child processes of the Langflow process running Python credential harvesters; cron entries writing to /usr/bin with random-name .sh; outbound HTTP to 23.234.98[.]182:9999; IRC traffic to 185.117.74[.]172:6667 from a host running an AI workflow platform (out-of-band for that workload class); SimpleHelp RAT artifacts on disk.
  • Hunt Attacker-2 shape: XMR coinbase/mempool traffic from the host; Chisel SOCKS5 tunnels; auditd/journald stop or log-gap events correlating with process-tree anomalies; .sysd, .cache-sysd, .watchdog.sh files; /app/a-style territory markers; outbound SSH from the Langflow host to unfamiliar IPs (216.78.235[.]34 pivot).
  • Exposure: assume any internet-facing Langflow with an unauthenticated or default-credential path was probed; treat patching as necessary but not sufficient — these canary victims show post-exploitation that outlives the initial RCE.

Response guidance

  1. Upgrade Langflow to a current release covering the CVE set above and verify all replicas/images were replaced.
  2. Remove public access where not explicitly required; place authentication and network controls in front of remaining deployments.
  3. Scope adjacent systems reachable from Langflow workloads (model providers, vector stores, databases, cloud metadata, CI secrets).
  4. Rotate secrets readable by the Langflow process after containment; preserve logs, process trees, and network telemetry before rebuild.

Sources