Langflow CVE-2026-33017 actively exploited — KeyHunter botnet uses NATS-as-C2 to harvest cloud and AI API keys

CVE-2026-33017 is an unauthenticated remote code execution in Langflow, reachable through the flow-building endpoint, and CISA added it to the KEV catalog before observed abuse landed within 20 hours of the listing. Sysdig's Threat Research Team documented a May 5 intrusion where the attacker used the endpoint to dump process environment variables, extracted AWS access keys within minutes, and fanned out across Bedrock, S3, EC2, Lambda and IAM. The operator then attempted LLMjacking, running inference on premium models such as Claude and Llama 3 on the victim's bill. Control plane traffic runs through a hardened NATS server with subject-level ACLs, coordinating a botnet named KeyHunter whose workers scrape CodePen, JSFiddle, StackBlitz and CodeSandbox for leaked API keys, with uTLS browser fingerprint spoofing, multi-architecture builds, systemd persistence and 65,535 file descriptor limits on cheap ARM VPS instances the operator treats as disposable.

The 20-hour gap between KEV listing and first observed exploitation removes any assumption that catalog listing buys a patch window, and the target profile makes it worse: Langflow is typically deployed as internal AI tooling on a cloud VM with an attached IAM role, so one unauthenticated request to the flow-building endpoint converts an experiment somebody spun up into the shortest path to the whole AWS account. Monetization through LLMjacking rather than ransomware means the victim's data is untouched, the abuse blends into legitimate model inference on the bill, and orgs can bleed premium-model spend for weeks without a visible intrusion signal, which is exactly why this story outranks the day's ordinary RCE noise. The KeyHunter half widens the exposure beyond Langflow owners: the same workers harvesting keys from process environments also mine public sandboxes where developers paste tokens, so your credential exposure now depends on the worst paste anyone on your team ever made, not just your patch state. Sysdig ties this operator to the May 12 TeamPCP campaign that compromised 84 TanStack npm packages as related but separate, which reads as a credential-harvesting economy, not a single bug.

Patch Langflow to the vendor release that fixes CVE-2026-33017 and keep the flow-building endpoint off the public internet and behind authentication until then. Rotate every AWS access key that could have sat in a process environment on a Langflow host since at least May 5, and audit what IAM roles those hosts carry. Hunt in AWS audit trails for Bedrock usage anomalies the events describe: inference against premium models like Claude or Llama 3 that no legitimate workload explains, plus correlated S3, EC2, Lambda and IAM calls from unfamiliar principals. On the hosts themselves, look for unexpected systemd units, unusually high file descriptor limits, and outbound NATS connections; on the network edge, treat NATS sessions to unknown brokers as C2 until proven otherwise. Sweep CodePen, JSFiddle, StackBlitz and CodeSandbox for your own leaked tokens and revoke on sight.

Two developments would change this assessment. Confirmed infrastructure overlap between KeyHunter and the TeamPCP npm supply chain operation would collapse two incidents into one coordinated credential economy and justify org-wide key rotation beyond Langflow hosts. And KeyHunter workers expanding past AWS and the four named sandboxes, or LLMjacking spreading beyond Bedrock-hosted models to other clouds, would signal the harvesting model scaling past what patch-and-rotate defense can contain.