Case langflow-flodrixAI supply chainWorldwide
Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet
After CISA added the unauthenticated Langflow code-injection flaw to KEV, attackers used public exploits on exposed AI workflow servers to install the Flodrix DDoS botnet.
CriticalAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 17, 2025
- Location
- Worldwide
- Target
- Langflow servers
- Severity
- Critical
- Triggered by
- Unknown Flodrix botnet operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- CVE-2025-3248
What happened
After CISA added the unauthenticated Langflow code-injection flaw to KEV, attackers used public exploits on exposed AI workflow servers to install the Flodrix DDoS botnet.
Impact: Full compromise of unpatched internet-exposed Langflow servers, enrolment into the Flodrix DDoS botnet and possible exposure of AI workflows and credentials; victim count not disclosed
Who triggered it
Actor: Unknown Flodrix botnet operators
Attribution: No public attribution; campaign documented by Trend Micro Research, exploitation confirmed by CISA KEV listing
Motive: Building a DDoS botnet; potential data theft from compromised AI servers
How it happened
Attack vector: Unauthenticated code injection in the /api/v1/validate/code endpoint of Langflow, exploited with public PoCs to drop a 'docker' shell script that fetches Flodrix ELF binaries
Root cause: Missing authentication and unsafe evaluation of user-supplied Python in the code-validation endpoint of Langflow versions before 1.3.0; many instances exposed to the internet unpatched
Timeline
- Langflow 1.3.0 released fixing CVE-2025-3248 (CVSS 9.8)
- CISA adds CVE-2025-3248 to the Known Exploited Vulnerabilities catalog
- Trend Micro publishes analysis of Flodrix botnet campaign exploiting exposed Langflow servers
Response
Langflow patched in v1.3.0; CISA mandated federal patching via KEV; Trend Micro published IOCs and urged upgrades and network isolation
Current status: Patched
Sources (open in a new tab)
- Trend Micro trendmicro.com
- SecurityWeek securityweek.com
- Dark Reading darkreading.com
Cite this case
Langflow AI agent builder RCE (CVE-2025-3248) exploited to spread Flodrix botnet. AI Threat Watch, case langflow-flodrix, Jun 17, 2025. https://aithreat.io/cases/langflow-flodrix/
Permanent link: https://aithreat.io/cases/langflow-flodrix/