CVE-2025-34291 Details
Description
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
A critical vulnerability chain has been identified in Langflow versions through 1.6.9, allowing for account takeover and remote code execution. This issue arises from an overly permissive Cross-Origin Resource Sharing (CORS) configuration that permits cross-origin requests with credentials from any origin. Additionally, the refresh token cookie is set to 'SameSite=None', enabling malicious webpages to hijack tokens by calling the refresh endpoint. Exploiting this vulnerability allows attackers to gain access to authenticated endpoints, including those with code execution capabilities, leading to full system compromise.
Users can manually update their CORS settings to mitigate this vulnerability. The Langflow team has also released version 1.6.0, which introduces environment variables to customize CORS configurations. In the upcoming version 1.7, Langflow will implement more secure defaults for both CORS and the refresh token cookie.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291 | CISA-ADP | US Government Resource |
| https://www.crowdsec.net/vulntracking-report/cve-2025-34291 | CISA-ADP | Third Party Advisory |
| https://github.com/langflow-ai/langflow | [email protected] | Product |
| https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform | [email protected] | ExploitMitigationThird Party Advisory |
| https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce | [email protected] | Third Party Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Langflow Origin Validation Error Vulnerability | May 21, 2026 | Jun 4, 2026 | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| langflow langflow | <= 1.6.9 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 22, 2026 | Modified Analysis | [email protected] |
| May 21, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jan 16, 2026 | Initial Analysis | [email protected] |
| Dec 5, 2025 | New CVE Received | [email protected] |