Security

Langflow AI Model Files Under Siege: The Rise of ENCFORGE Ransomware

Published

2 hours ago

July 22, 2026

BTI Team

Implement proper authentication for the /api/v1/validate/code endpoint to prevent unauthorized remote access.

Regularly monitor and update your AI infrastructure to protect against known vulnerabilities and emerging threats.

Consider implementing network segmentation and access controls to limit the impact of potential breaches.

Educate employees on cybersecurity best practices and the importance of maintaining strong security measures.

Enhancing Cybersecurity Measures for Langflow Process Protection

Version 1.3.0 recently closed CVE-2025-3248, the entry point for a malicious campaign. However, CISA has identified two additional vulnerabilities within Langflow: CVE-2026-33017, an unauthenticated remote code execution flaw resolved in version 1.9.0, added to the KEV catalog on March 25, 2026; and CVE-2026-55255, a cross-user authorization bypass fixed in version 1.9.1, added on July 7, 2026.

It is crucial to regularly rotate AI provider keys, cloud credentials, database secrets, and any other tokens accessible to the Langflow process. Simply patching vulnerabilities may not revoke credentials that have already been compromised.

Remove /var/run/docker.sock from any container that does not specifically require it. If socket access is necessary, limit it through a tightly configured proxy. Typically, a standard Langflow deployment does not need to create containers, and unrestricted Docker socket access should be considered a misconfiguration.

Be vigilant for application processes that call Docker container-creation APIs, containers launched with Privileged: true or PidMode: host, host-root bind mounts, and nsenter execution from within a container. Alert mechanisms should be in place to detect such activities.

It is advisable to store model weights, vector indexes, and training datasets in offline or immutable snapshots. Regularly monitor these directories for any unusual mass creation of .locked files.

The Hacker News reached out to Sysdig’s Threat Research Team for more information on the extent of the fleet campaign and the confidence level in attribution. No response had been received by the time of publication.

It is essential to treat model artifacts with the same level of importance as source code and production databases. An organization that can rebuild its application but cannot restore its weights, indexes, or training state may face challenges in recovering from a security breach.