An old Langflow remote-code bug is being used in a new way. The Injection‘s week-45 roundup reports that VulnCheck honeypots caught an agentic credential-hunting campaign — the same activity Microsoft described in its ARTEX reporting — entering through unpatched Langflow servers. VulnCheck’s canaries recorded the same IP address named in Microsoft’s report exploiting CVE-2025-3248, then running 11 scripted stages that dumped environment variables and decrypted stored provider keys.
Quick Take
- Bug: CVE-2025-3248, a previously disclosed Langflow flaw, is being exploited in November 2026, not as a novelty scan but as a door for an agentic secret hunter.
- What the agent did: VulnCheck says the exploit path ran 11 scripted stages, dumped environment variables, and decrypted stored provider keys.
- Link to Microsoft’s reporting: The same IP address named in Microsoft’s agentic AI report showed up on VulnCheck’s canaries.
- What to do: Take Langflow off the public internet, patch it, and put it behind authentication or a VPN. Treat every key inside an exposed instance as compromised: rotate provider keys first, then the Langflow secret key.
What happened
Langflow is a widely deployed visual builder for LLM flows, and internet-facing instances have been a recurring target. CVE-2025-3248 is not a brand-new 2026 disclosure; the news this week is that a modern agentic campaign is still finding unpatched servers and turning them into a key dump.
VulnCheck’s honeypot account is specific: the exploit was not a single probe. It followed a scripted, multi-stage playbook aimed at secrets. The Injection’s advice, drawn from that report, is to hunt for behaviour rather than only for addresses — for example bursts of large validate/code POST requests and request bodies containing @exec(.
Mitigation
- Remove public exposure. Langflow should not be on the open internet.
- Patch to a fixed release that addresses CVE-2025-3248, then place the service behind authentication or a VPN.
- Rotate every provider key, database password and Langflow secret key that was stored in or available to an exposed instance. Assume theft, not just “maybe.”
- Look in logs for the behavioural patterns VulnCheck described, not only for a single indicator IP, which an agent can change.
What it means
This is the unglamorous side of AI security: a 2025 CVE, still unpatched on real servers, now driven by an agent that already knows how to loot keys and move on. The new work is not the vulnerability class. It is the speed and completeness of the follow-on stages once the door is open.
If you ran an internet-facing Langflow instance any time this year, rotate keys even if you are unsure whether this campaign reached you.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-45 summary of VulnCheck’s honeypot report (November 8, 2026) and the public CVE-2025-3248 record. i10x has not reviewed VulnCheck’s raw canary data.
