Langflow RCE Exploited for Botnet Delivery and Suspected Agentic Ransomware

Attackers exploited CVE-2025-3248, a critical authentication bypass in Langflow’s /api/v1/validate/code endpoint that permits unauthenticated remote code execution and server compromise. Langflow fixed the flaw in version 1.3.0, but its release notes described the change only as “auth current user on code validation.” After Horizon3 published an analysis and proof of concept, SANS observed scanning from Tor exit nodes, including a request attempting to read /etc/passwd. FortiGuard subsequently reported increased exploitation and Flodrix botnet delivery; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 5, 2025.

The flaw also provided initial access for JADEPUFFER, which Sysdig assessed as the first documented agentic ransomware operation. The activity collected secrets, established persistence, reached a separate production server, and encrypted 1,342 Nacos configuration items while deleting the original tables. The captured code neither retained nor transmitted the encryption key, making recovery through payment impossible based on that implementation. More than 600 purposeful payloads and rapid adaptation supported an assessment of LLM-driven activity, although the model, agent configuration, and human involvement remained unconfirmed. The operator later deployed ENCFORGE, a Go ransomware binary targeting approximately 180 file extensions associated with AI and machine-learning environments. Organizations should upgrade Langflow to version 1.3.0 or later, investigate exposed instances for compromise, and constrain AI-agent permissions with protected credentials, independent monitoring, action-specific approvals, and externally controlled shutdown capabilities.