Live › vulnerability › CVE-2025-34291
Go to dashboardLangflow <= 1.6.9 ships CORS allow_origins=* with credentials and a SameSite=None refresh-token cookie. Any webpage a logged-in user visits can call the refresh endpoint, get fresh tokens, and use the built-in code validation endpoint for RCE. Fixed in 1.7.0. CISA KEV lists it as exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Langflow Langflow | vendor | – | – |
| langflow | pypi | <= 1.6.9 | 1.7.0 |
| langflow | vendor | <= 1.6.9 | – |
pip show langflow (or check the container image tag): versions <= 1.6.9 are vulnerable; LANGFLOW_CORS_ALLOW_CREDENTIALS should be false if origins are '; LANGFLOW_REFRESH_SAME_SITE should be lax or strict1.7.01.9.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2025-34291")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.