Hackers Exploit Langflow Vulnerability to Unleash Flodrix Botnet and Gain System Control

A critical security incident has emerged as threat actors are actively exploiting a high-severity vulnerability in Langflow, a widely used Python-based framework that powers AI application development.

Identified as CVE-2025-3248 and carrying a CVSS score of 9.8, this vulnerability affects all Langflow versions prior to 1.3.0 and enables unauthenticated remote code execution (RCE) through the /api/v1/validate/code endpoint.

The flaw, which results from a lack of input validation and sandboxing, allows attackers to execute arbitrary Python code on exposed systems simply by sending a specially crafted POST request.

Trend Micro was among the first to report the ongoing campaign, which has drawn immediate concern due to the ease of exploitation and the potential for complete system compromise.

Advanced Capabilities

This vulnerability is being leveraged as part of an active campaign to distribute the Flodrix botnet, a sophisticated successor of the LeetHozer malware family.

The attack sequence begins with cybercriminals using tools like Shodan and FOFA to scan for publicly accessible Langflow instances.

Once a vulnerable target is identified, attackers utilize open-source proof-of-concept exploits from repositories such as GitHub to gain initial access, running reconnaissance commands (whoami, printenv, ip addr show) to harvest system data, which is transmitted to remote command-and-control servers.

Following this, a downloader script commonly misnamed as “docker” retrieves and installs the Flodrix malware payload, often via TCP connections or through the Tor network.

Flodrix is engineered to execute distributed denial-of-service (DDoS) attacks using multiple techniques, including tcpraw and udpplain, but its danger extends further.

The malware incorporates advanced evasion mechanisms, such as self-deleting if not run with specific parameters, erasing forensic traces, employing XOR-based string obfuscation, and checking for hidden files like .system_idle to prevent reinfection.

It also spawns child processes with misleading names to avoid detection by system administrators or automated defenses.

Global Impact

With over 70,000 GitHub stars, Langflow enjoys widespread adoption, making it a lucrative target for cybercriminals.

Security analysts have identified more than 1,600 internet-facing Langflow deployments worldwide, though the true scope of vulnerable installations remains undetermined.

The repercussions of Flodrix infections are significant, ranging from service outages caused by DDoS attacks to potential exfiltration of sensitive data, threatening organizations that rely on Langflow for intelligent automation and prototyping.

Mitigation demands immediate upgrading to Langflow version 1.3.0 or later, which addresses the vulnerability by introducing authentication via a _current_user: CurrentActiveUser parameter for the affected endpoint.

In addition to software patching, security teams are advised to restrict public network access to Langflow endpoints and closely monitor systems for signs of compromise.

Key indicators include unexpected outbound network connections, unusual process activity, and hidden files commonly used by malware for persistence or evasion.

This campaign highlights the ongoing risks posed by unauthenticated RCE flaws in open-source software, particularly when coupled with the rapid weaponization of readily available exploits.

Organizations must prioritize prompt patching and robust monitoring to defend against dynamic threats like the Flodrix botnet.

Indicators of Compromise (IOCs)

IOC SHA256 Hash
AB0F9774CA88994091DB0AE328D98F45034F653BD34E4F5E85679A972D3A039C
C2BCDD6E3CC82C4C4DB6AAF8018B8484407A3E3FCE8F60828D2087B2568ECCA4
EC52F75268B2F04B84A85E08D56581316BD5CCFEB977E002EB43270FE713F307
CCB02DCE1BCA9C3869E1E1D1774764E82206026378D1250AED324F1B7F9B1F11
F73B554E6AA7095CFC79CDB687204D99533AEDA73309106BA6CC9428FF57BD1E
EE84591092A971C965B4E88CC5D6E8C2F07773B3BEE1486F3A52483EE72A2B3B
002F3B2C632E0BE6CBC3FDF8AFCD0432FFE36604BA1BA84923CADAA147418187
99B59E53010D58F47D332B683EB8A40DF0E0EACEF86390BCA249A708E47D9BAD
08CF20E54C634F21D8708573EEF7FDE4DBD5D3CD270D2CB8790E3FE1F42ECCEC
6DD0464DD0ECDE4BB5A769C802D11AB4B36BBE0DD4F0F44144121762737A6BE0
C462A09DB1A74DC3D8ED199EDCA97DE87B6ED25C2273C4A3AFE811ED0C1C8B1D
9850EB26D8CBEF3358DA4DF154E054759A062116C2AA82DE9A69A8589F0DCE49
A42F8428AA75C180C2F89FBB8B1E44307C2390ED0EBF5AF10015131B5494F9E1
ABB0C4AD31F013DF5037593574BE3207A4C1E066A96E58CE243AAF2EF0FC0E4D
DF9E9006A566A4FE30EAA48459EC236D90FD628F7587DA9E4A6A76D14F0E9C98

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates