Langflow Flaws Enable Cross-Tenant Access and Fuel Cryptominer Intrusions

Multiple vulnerabilities in Langflow have exposed AI application deployments to both account-to-account abuse and active compromise. CVE-2026-33760 affects versions before 1.9.0 and allows authenticated users to read, modify, rename, or delete other users’ messages, sessions, build artifacts, and LLM transaction logs through seven /api/v1/monitor endpoints that fail to enforce ownership checks. A separate flaw, CVE-2026-55255, affects versions before 1.9.2 and lets an authenticated attacker execute another user’s flow through the /api/v1/responses endpoint by supplying a victim flow_id, giving the issue a critical CVSS 9.9 rating.

At the same time, defenders are tracking a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated remote code execution bug in Langflow, to compromise exposed instances and deploy Monero miners. Threat research says the malware disables security controls, installs persistence, and can enable lateral movement through reused SSH keys; observed infrastructure includes 83.142.209.214 and 94.156.64.241. Organizations running Langflow are being urged to upgrade to 1.9.0 and 1.9.2 or later as applicable, verify access-control enforcement, restrict public exposure of Langflow services, and treat signs of miner activity or unauthorized flow execution as a significant incident.