Loading story…
Multiple vulnerabilities in Langflow have exposed AI application deployments to both account-to-account abuse and active compromise. CVE-2026-33760 affects versions before 1.9.0 and allows authenticated users to read, modify, rename, or delete other users’ messages, sessions, build artifacts, and LLM transaction logs through seven /api/v1/monitor endpoints that fail to enforce ownership checks. A separate flaw, CVE-2026-55255, affects versions before 1.9.2 and lets an authenticated attacker execute another user’s flow through the /api/v1/responses endpoint by supplying a victim flow_id, giving the issue a critical CVSS 9.9 rating.
At the same time, defenders are tracking a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated remote code execution bug in Langflow, to compromise exposed instances and deploy Monero miners. Threat research says the malware disables security controls, installs persistence, and can enable lateral movement through reused SSH keys; observed infrastructure includes 83.142.209.214 and 94.156.64.241. Organizations running Langflow are being urged to upgrade to 1.9.0 and 1.9.2 or later as applicable, verify access-control enforcement, restrict public exposure of Langflow services, and treat signs of miner activity or unauthorized flow execution as a significant incident.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A critical vulnerability, CVE-2026-10140, was disclosed in IBM Langflow OSS versions 1.0.0 through 1.10.0 affecting the voice mode subsystem. The flaw allows authenticated attackers to manipulate shared cache state so requests from other tenants are processed with incorrect upstream API credentials, enabling cross-tenant billing fraud and accountability misattribution.
IBM disclosed CVE-2026-7663 affecting Langflow OSS versions 1.0.0 through 1.9.6, an improper authorization flaw that lets unauthenticated attackers access protected MCP project resources and execute MCP operations via the Streamable MCP transport endpoint. IBM recommended upgrading to Langflow 1.9.7 or later to remediate the issue.
Sysdig Threat Research Team reported the first known in-the-wild exploitation of CVE-2026-55255 on June 25, 2026, against an internet-exposed Langflow instance. The observed operator at 45.207.216.55 enumerated flow IDs and abused the /api/v1/responses IDOR to execute victim flows with prompts such as "leak api keys," alongside repeated CVE-2026-33017 exploitation against the same target.
A cryptocurrency-mining campaign was reported exploiting CVE-2026-33017, an unauthenticated remote code execution flaw in Langflow, against exposed AI application endpoints. The activity disabled host security controls, deployed a custom miner, established persistence, and used infrastructure including 83.142.209.214 and 94.156.64.241.
Langflow fixed CVE-2026-55255 in version 1.9.2. The vulnerability in the /api/v1/responses endpoint allowed an authenticated attacker to execute another user's flow by supplying the victim's flow ID.
Langflow addressed CVE-2026-33760 in version 1.9.0. The flaw affected seven /api/v1/monitor endpoints that failed to enforce ownership checks, allowing authenticated users to access, modify, rename, or delete other users' resources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcewebflow.sysdig.com
Open sourcecommunity.gurucul.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026
Langflow disclosed a high-impact insecure direct object reference vulnerability, tracked as **`GHSA-qrpv-q767-xqq2`**, that allowed any authenticated user on affected deployments to access and execute another user’s flow through the **`/api/v1/responses`** endpoint. The flaw affected pip package versions earlier than **`1.9.1`** and stemmed from backend logic that resolved flows by UUID without verifying ownership, enabling an attacker to submit a victim’s flow UUID and receive the resulting output. Successful exploitation could expose sensitive data processed by the victim’s flow and consume the victim’s compute resources. The fix, merged in PR **`#12832`**, added ownership checks for both UUID- and endpoint-name-based flow lookups and changed unauthorized access handling to return **`404`** instead of **`403`** to avoid revealing whether a target flow exists. Langflow also hardened related routes, including **`/api/v1/run`**, **`/api/v1/run/session`**, and **`/api/v1/run/advanced`**, to close similar unscoped dependency patterns, and added regression tests covering cross-user access, malformed **`user_id`** inputs, and the reported proof of concept. Users are advised to upgrade to **`1.9.1`** or later.
Jun 29, 2026
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026