Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

A critical Remote Code Execution (RCE) vulnerability (CVE-2026-33017) in Langflow is being exploited by threat actors to deploy a Monero cryptocurrency miner on exposed AI application endpoints. The campaign, active from March 27 to April 15, 2026, leverages a sophisticated malware payload that terminates competing miners, disables security controls, and establishes persistence, highlighting the increasing risk of AI infrastructure being targeted for cryptomining operations. This attack demonstrates the potential for commodity cryptominer operators to gain access to enterprise networks through vulnerabilities in AI application platforms.