Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

This report describes an active campaign exploiting a critical unauthenticated Langflow RCE (CVE-2026-33017, CVSS 9.3) to deliver a custom Monero miner ('lambsys'). The attacker-run dropper fetches and launches an ELF miner that disables host security controls, removes logs, establishes persistence via cron, spreads via reused SSH keys, and contacts an external server for additional payloads and geolocation-aware pool selection; IOCs and historical context for Langflow exploitation are provided.