Security researchers have uncovered an active cyberattack campaign targeting Langflow servers through CVE-2025-3248, a critical remote code execution vulnerability. This vulnerability allows threat actors to deploy the sophisticated Flodrix botnet malware, which can compromise cloud infrastructure and expand botnet operations. The attack culminates with the deployment of a Trojan downloader script that fetches and executes the Flodrix botnet payload, leading to significant system compromise and potential data breaches.
Source: https://cybersecuritynews.com/langflow-rce-vulnerability-exploited/
TPRM report: https://scoringcyber.rankiteo.com/company/the-lang-company
"id": "the228061725",
"linkid": "the-lang-company",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Cloud Infrastructure',
'name': 'Langflow',
'type': 'Organization'}],
'attack_vector': 'Exploitation of CVE-2025-3248 vulnerability',
'description': 'Security researchers have uncovered an active cyberattack '
'campaign targeting Langflow servers through CVE-2025-3248, a '
'critical remote code execution vulnerability that allows '
'threat actors to deploy the sophisticated Flodrix botnet '
'malware.',
'impact': {'systems_affected': 'Langflow servers'},
'initial_access_broker': {'entry_point': '/api/v1/validate/code endpoint'},
'motivation': 'Expand botnet operations',
'post_incident_analysis': {'corrective_actions': ['Upgrade to Langflow '
'version 1.3.0 or later',
'Restrict public access to '
'Langflow endpoints',
'Monitor for indicators of '
'compromise',
'Scan for hidden files like '
'.system_idle'],
'root_causes': 'Lack of adequate authentication in '
'the /api/v1/validate/code '
'endpoint'},
'recommendations': ['Immediately upgrade to Langflow version 1.3.0 or later',
'Restrict public access to Langflow endpoints',
'Monitor for indicators of compromise',
'Scan for hidden files like .system_idle'],
'references': [{'source': 'ANY.RUN'}],
'response': {'remediation_measures': ['Upgrade to Langflow version 1.3.0 or '
'later',
'Restrict public access to Langflow '
'endpoints',
'Monitor for indicators of compromise',
'Scan for hidden files like '
'.system_idle']},
'threat_actor': 'Unknown',
'title': 'Langflow RCE Vulnerability Exploited to Deploy Flodrix Botnet',
'type': 'Remote Code Execution',
'vulnerability_exploited': 'CVE-2025-3248'}