{"id":"CVE-2025-34291","kind":"vulnerability","aliases":["CVE-2025-34291"],"related":[],"title":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote…","description":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","summary":"Langflow <= 1.6.9 ships CORS allow_origins=* with credentials and a SameSite=None refresh-token cookie. Any webpage a logged-in user visits can call the refresh endpoint, get fresh tokens, and use the built-in code validation endpoint for RCE. Fixed in 1.7.0. CISA KEV lists it as exploited.","severity":"critical","cvss":9.4,"epss":null,"exploited":true,"exploited_at":"2026-05-21T00:00:00+00:00","products":[{"name":"Langflow Langflow","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"langflow","fixed":["1.7.0"],"affected":"<= 1.6.9","ecosystem":"pypi"},{"name":"langflow","fixed":[],"affected":"<= 1.6.9","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-tooling","ai-workflows","cors","exploited","langflow","rce","self-hosted"],"not_affected_if":["managed-hosting","no-browser-users","version-1.7.0-or-later"],"how_to_check":"Run 'pip show langflow' (or check the container image tag): versions <= 1.6.9 are vulnerable. Also check env vars: LANGFLOW_CORS_ORIGINS should list specific origins, not '*'; LANGFLOW_CORS_ALLOW_CREDENTIALS should be false if origins are '*'; LANGFLOW_REFRESH_SAME_SITE should be lax or strict. The maintainer notes the SameSite default may still be permissive after upgrade, so set it explicitly. Review logs for unexpected requests to /api/v1/validate/code.","fix":"Upgrade to langflow >= 1.7.0. The maintainer recommends the latest stable release, which they give as 1.9.3. Set LANGFLOW_CORS_ORIGINS to your exact domains, set LANGFLOW_REFRESH_SAME_SITE=lax or strict, and restrict network access (VPN or trusted network). Rotate API keys and tokens stored in any instance that was exposed.","status":"open","published_at":"2025-12-05T23:15:47+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:34:05+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T20:34:05Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations referenced by CISA; the specific fixed version is unknown from these sources. If mitigations are unavailable, CISA says to discontinue use of the product.","summary":"Langflow, an AI workflow builder, has an overly permissive CORS policy combined with a SameSite=None refresh token cookie, so a malicious webpage can get a logged-in user's refresh token and call authenticated endpoints. The sources say this can lead to arbitrary code execution and full system compromise, and CISA lists it as actively exploited.","category":"ai-tooling","who_cares":["langflow","self-hosted","ai-workflows"],"confidence":0.6,"analyst_note":"Find the vendor advisory and the fixed Langflow version and a config check for CORS and refresh cookie settings; the CISA KEV entry only gives a generic instruction.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-browser-users"],"severity_if_unknown":"critical"},"cost_usd":0.000391,"input_tokens":2141,"output_tokens":354,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed Langflow version and a config check for CORS and refresh cookie settings; the CISA KEV entry only gives a generic instruction.","search":"'-2025':19A,22A '-34291':20A,23A '1.6.9':7A,42B,99C '1.7.0':86B 'access':161C,173C 'account':14A,106C 'achiev':193C 'ai':29B,32B 'ai-tool':28B 'ai-workflow':31B 'allow':45B,117C,120C,133C,185C 'arbitrari':190C 'attack':154C,187C 'attacker-control':153C 'authent':175C 'built':77B,179C 'built-in':76B,178C 'call':66B,148C 'chain':10A,102C 'cisa':87B 'code':79B,110C,182C,191C 'code-execut':181C 'combin':123C 'compromis':196C 'configur':116C,129C 'contain':8A,100C 'control':155C 'cooki':56B,128C 'cor':34B,44B,115C 'credenti':48B,121C,145C 'cross':140C 'cross-origin':139C 'cve':18A,21A 'enabl':13A,105C 'endpoint':69B,81B,151C,176C 'execut':111C,183C,189C 'exploit':35B,92B 'fix':84B 'fresh':71B,160C 'full':194C 'function':184C 'get':70B 'host':40B 'includ':6A,98C,144C,177C 'kev':88B 'langflow':1A,24A,25A,26A,27A,36B,41B,93C 'list':89B 'log':61B 'logged-in':60B 'malici':135C 'none':52B,132C 'obtain':159C,170C 'origin':46B,118C,141C,156C 'over':113C 'pair':165C 'perform':138C 'permiss':114C 'permit':172C 'rce':37B,83B 'refresh':54B,68B,126C,150C,163C 'refresh-token':53B 'remot':17A,109C 'request':142C 'samesit':51B,131C 'self':39B 'self-host':38B 'session':169C 'ship':43B 'success':147C 'system':195C 'takeov':15A,107C 'therefor':158C 'token':55B,72B,127C,162C,164C,171C 'tool':30B 'true':122C 'use':74B 'user':63B 'valid':80B 'version':2A,94C 'victim':168C 'visit':64B 'vulner':11A,103C 'webpag':58B,136C 'workflow':33B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-12-05T23:15:47+00:00","kev":{"dateAdded":"2026-05-21","dueDate":"2026-06-04","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-34291","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34291","severity":null,"published_at":"2026-05-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-34291:19","url":null,"severity":null,"published_at":"2026-10-23T20:36:41+00:00","modified_at":"2026-10-23T20:36:41+00:00","first_seen_at":"2026-10-23T20:36:41+00:00","fetched_at":"2026-10-23T20:36:41+00:00","note":"GHSA-577h-p2hh-v4mv: langflow (pip) <= 1.6.9 affected, fixed in 1.7.0 (CORS hardened, PR #9744 per maintainer); maintainer gives env-var mitigations in issue #11465; KEV exploitation from CISA. No public PoC link verified; Obsidian writeup describes the chain."},{"source":"nvd","external_id":"CVE-2025-34291","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34291","severity":null,"published_at":"2025-12-05T23:15:47+00:00","modified_at":"2026-10-15T21:10:00+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":846,"url":"https://github.com/advisories/ghsa-577h-p2hh-v4mv","title":"GHSA-577h-p2hh-v4mv Langflow CORS misconfiguration enables Account Takeover and RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":847,"url":"https://github.com/langflow-ai/langflow/issues/11465","title":"Inquiry Regarding CVE-2025-34291 Patch (maintainer mitigation guidance)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":848,"url":"https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","title":"Obsidian Security: CVE-2025-34291 writeup","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}