CVE-2026-33017 Langflow RCE: Web Server Spawning Shell/Dropper Processes

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•6

This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).