Langflow AI Pipeline Exploitation (CVE-2026-55255): Chained RCE & IDOR Credential Theft

title: Langflow Exploitation - Suspicious Network Connection to C2
id: 3a1b5c6d-7e8f-9g0h-1i2j-3k4l5m6n7o8p
description: Detects connections to the known malicious IP associated with the Langflow exploitation campaign.
status: experimental
date: 2026/07/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a5e6b5e6b5e6b5e6b5e6b5/
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp|startswith: '45.207.216.55'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Potential Langflow RCE - Python Spawning Shell
id: 4b2c6d7e-8f9g-0h1i-2j3k-4l5m6n7o8p9q
description: Detects Python processes (typical for Langflow) spawning cmd.exe or bash, indicative of RCE exploitation.
status: experimental
date: 2026/07/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a5e6b5e6b5e6b5e6b5e6b5/
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\python.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\bash'
    condition: all of selection_*
falsepositives:
    - Legitimate developer debugging activity
level: high
---
title: Langflow Environment Variable Access (Credential Theft)
id: 5c3d7e8f-9g0h-1i2j-3k4l-5m6n7o8p9q0r
description: Detects processes reading .env files or accessing environment variable stores within the Langflow directory context.
status: experimental
date: 2026/07/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a5e6b5e6b5e6b5e6b5e6b5/
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    category: file_access
detection:
    selection:
        TargetFilename|contains: '.env'
    filter:
        Image|contains: 'langflow'
    condition: selection and not filter
falsepositives:
    - Application startup
level: medium


kql
// Hunt for connections to the known malicious IP
DeviceNetworkEvents
| where RemoteIP == "45.207.216.55"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Timestamp desc


powershell
# Langflow IOC Hunt Script
# Checks for network connections to the malicious IP and unusual processes

Write-Host "[+] Checking for active connections to 45.207.216.55..."
$netstat = netstat -ano | Select-String "45.207.216.55"
if ($netstat) {
    Write-Host "[!] ALERT: Found connection to malicious IOCs:" -ForegroundColor Red
    Write-Host $netstat
} else {
    Write-Host "[-] No active connections found." -ForegroundColor Green
}

Write-Host "[+] Checking for Langflow processes spawning shells..."
$processes = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "cmd.exe" -or $_.Name -eq "powershell.exe" }
foreach ($proc in $processes) {
    $parent = Get-WmiObject Win32_Process | Where-Object { $_.ProcessId -eq $proc.ParentProcessId }
    if ($parent.Name -like "*python*" -or $parent.CommandLine -like "*langflow*") {
        Write-Host "[!] ALERT: Suspicious shell spawned by Langflow/Python:" -ForegroundColor Red
        Write-Host "Process: $($proc.Name) | Parent: $($parent.Name) | Command: $($parent.CommandLine)"
    }
}