CVE-2025-34291: Langflow CORS misconfiguration leads to token theft and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score 9.4, CISA KEV listing with a 2026-06-04 remediation due date, and a 99.7th percentile EPSS probability make this an actively exploited, remotely reachable path to full compromise.

What it is

Langflow up to and including 1.6.9 ships an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token cookie set to SameSite=None. A malicious webpage can make credentialed cross-origin requests to the refresh endpoint and obtain fresh access/refresh token pairs for a victim session. The stolen tokens unlock authenticated endpoints, including built-in code execution, leading to full system compromise.

Impact

An attacker who lures a logged-in victim to a malicious page gains that user's tokens, takes over the account, and can execute arbitrary code on the Langflow host, resulting in full system compromise.

Attack surface

Reachable over the network through a victim's browser: the attacker needs the victim to visit a malicious webpage (UI:P) while authenticated, and no prior authentication is required by the attacker (PR:N). The flaw is in origin validation on the refresh endpoint, not in an authenticated API path.

Exploitation

CVE-2025-34291 is listed in CISA KEV (added 2026-05-21) and has an EPSS 30-day probability of 0.836 (99.7th percentile), and a reference is tagged Exploit, indicating active exploitation. No ransomware campaign use is documented.

What to do

• Upgrade Langflow past 1.6.9 to a fixed release as soon as the vendor provides one; treat 1.6.9 and earlier as vulnerable.
• If patching is not immediately possible, restrict CORS to explicit trusted origins and stop sending credentials with wildcard origins, and set the refresh token cookie to SameSite=Strict or Lax.
• Isolate Langflow instances from untrusted networks and do not expose the UI or API directly to the internet.
• Rotate all Langflow session tokens, refresh tokens and any credentials or secrets reachable from the instance, since token theft may already have occurred.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.

Detection

• Monitor Langflow access logs for refresh endpoint requests with unexpected or attacker-controlled Origin headers, especially cross-origin requests carrying cookies.
• Alert on token refresh or authenticated API calls from IP addresses or user agents that differ from the victim's normal session.
• Hunt for use of Langflow code-execution endpoints shortly after a token refresh, particularly from new source IPs.
• Review outbound connections and process execution on Langflow hosts for signs of post-exploitation activity following suspicious token use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.