Loading story…
Attackers are actively exploiting CVE-2025-3248, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized Gafgyt/BASHLITE malware variant on x86_64 Linux systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement.
The malware reportedly supports multiple flood modes, including UDP, TCP, HOLD, and junk/STD, and uses a modified RC4-based cipher to obscure command-and-control traffic and hinder standard decoding. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, while GreyNoise observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a WAF, enforce outbound filtering including blocking unauthorized traffic such as port 1337, and deploy YARA detections keyed to the malware’s distinctive cipher seed bytes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
GreyNoise observed hundreds of source IP addresses exploiting CVE-2025-3248 against internet-exposed Langflow systems. This indicated broad scanning or exploitation activity tied to the flaw.
CISA added Langflow remote code execution flaw CVE-2025-3248 to its Known Exploited Vulnerabilities catalog. The reference cites this as evidence that the vulnerability was being actively exploited.
Akamai reported that the malware used a modified RC4-based mechanism to obscure command-and-control traffic and evade standard decoding tools. The bot supported multiple flood modes including UDP, TCP, HOLD, and junk/STD attacks.
Attackers actively exploited CVE-2025-3248 in Langflow's code validation API endpoint to execute untrusted Python and download a Linux payload on x86_64 systems. The post-exploitation activity delivered a customized Gafgyt/BASHLITE bot focused on DDoS operations rather than cryptomining or lateral movement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026
Threat actors rapidly exploited **CVE-2026-33017**, a critical unauthenticated remote code execution flaw in Langflow’s public flow build endpoint, allowing arbitrary Python code to reach an unsandboxed `exec()` path with a single crafted request. The bug affects Langflow versions prior to **1.9.0** and stems from the `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint accepting attacker-controlled flow data through an optional parameter. Researchers and vendor advisories said the issue is distinct from **CVE-2025-3248** because the vulnerable endpoint is intentionally public, meaning the fix required removing attacker-supplied flow data from that execution path rather than simply adding authentication. Sysdig and other researchers reported exploitation beginning within about **20 hours** of disclosure, with attackers scanning for exposed instances, validating code execution, reading files such as `.env`, `.db`, and `/etc/passwd`, stealing credentials, API keys, and database secrets, and attempting follow-on payload delivery from infrastructure including `173.212.205[.]251:8443`. The severity prompted **CISA** to add the flaw to its **Known Exploited Vulnerabilities** catalog and order federal agencies to remediate by **April 8, 2026** or discontinue use if they could not secure affected systems. Security guidance across the reports urged organizations to upgrade to **Langflow 1.9.0 or later**, restrict or remove internet exposure of the vulnerable endpoint, monitor outbound connections, and rotate secrets if compromise is suspected.
Jul 2, 2026
CISA added **Langflow** vulnerabilities to its Known Exploited Vulnerabilities catalog after evidence of active attacks, ordering U.S. federal agencies to remediate **`CVE-2026-55255`** by **July 10**. The flaw is an insecure direct object reference in **`/api/v1/responses`** that lets an authenticated attacker use a victim flow UUID to access another user's flow, exposing sensitive data and consuming the victim's resources. Reporting also tied Langflow to broader KEV updates, including **`CVE-2025-3248`**, a missing-authentication flaw in **`/api/v1/validate/code`** that allows unauthenticated remote code execution and was updated in CISA's catalog to show **known ransomware use**. Sysdig said it observed in-the-wild exploitation of **`CVE-2026-55255`** on June 25, alongside repeated abuse of **`CVE-2026-33017`**, an unauthenticated Langflow RCE that attackers appeared to prefer because it is easier to operationalize and provides direct host compromise. The observed operator enumerated flows through **`/api/v1/flows/`**, then abused **`POST /api/v1/responses`** with prompts such as "leak api keys" to trigger another tenant's flow and attempt credential theft, while also deploying a malicious Langflow component that fetched a second-stage shell script from **`45.207.216.55:8084`**. Researchers assessed the activity as automated, opportunistic, and financially motivated, combining credential theft, compute abuse, implant delivery, and botnet-style monetization.
Jul 9, 2026