Langflow RCE Vulnerability Leads to Monero Cryptominer Deployment

Threat actors are actively exploiting CVE-2026-33017, a critical unauthenticated RCE in Langflow disclosed on March 20, 2026, to compromise internet-exposed AI application servers and silently deploy customized Monero cryptominers; exploitation has been observed since March 25, 2026, and organizations running Langflow should urgently assess exposure and apply mitigations.