CVE-2025-34291
published 2025-12-05CVE-2025-34291: Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS…
PriorityP193high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-06-04
Exploited in the wild
EPSS
83.63%
99.7th percentile
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langflow | langflow | <= 1.6.9 | — |
| langflow | langflow | 0 – 1.6.9 | — |
Detection & IOCsextracted from sources · hover to see the quote
sigma
Nuclei template id: CVE-2025-34291 — OPTIONS /api/v1/refresh with Origin header; match Access-Control-Allow-Origin + Access-Control-Allow-Credentials: true in response
- →Detect CORS misconfiguration probe: HTTP OPTIONS request to /api/v1/refresh with an arbitrary Origin header returning both 'Access-Control-Allow-Origin: <attacker-origin>' and 'Access-Control-Allow-Credentials: true' in the response headers.
- →Monitor for cross-origin POST requests to /api/v1/refresh that successfully return new access_token / refresh_token pairs — especially from origins not belonging to the legitimate Langflow deployment. ↗
- →Alert on POST requests to /api/v1/validate/code from sessions whose tokens were recently refreshed via a cross-origin request, as this endpoint provides built-in code-execution functionality. ↗
- →Shodan/FOFA exposure query: search for internet-facing Langflow instances using 'html:"Langflow"' (Shodan) or 'body="Langflow"' (FOFA) to identify attack surface; approximately 7,000 instances are publicly exposed.
- →CVE-2025-34291 has been actively exploited by the Iranian state-sponsored group MuddyWater as an initial access vector; correlate Langflow exploitation activity with subsequent OWA brute-force, credential harvesting, and data exfiltration TTPs targeting aviation, energy, and government sectors. ↗
- →Inspect response headers on all Langflow API endpoints for 'Access-Control-Allow-Origin: *' co-existing with 'Access-Control-Allow-Credentials: true' — this combination is the root misconfiguration enabling the attack chain. ↗
- ·Vulnerability only affects Langflow versions up to and including 1.6.9; version 1.7.0 and later (specifically v1.9.3 per CISA notes) restrict CORS origins properly.
- ·The attack chain requires three combined weaknesses to be present simultaneously: overly permissive CORS (allow_origins='*' with allow_credentials=True), absence of CSRF protection, and the presence of the code-execution endpoint — all three must exist for full exploitation. ↗
- ·Exploitation requires victim interaction (UI:R per CVSS) — the victim must visit a malicious webpage while authenticated to Langflow for the cross-origin credentialed request to succeed. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.4CRITICAL
cisa9.4CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Langflow up to 1.6.9 Refresh Endpoint origin validation (EUVD-2025-201507)
vuldb·2026-05-21·CVSS 9.4
CVE-2025-34291 [CRITICAL] Langflow up to 1.6.9 Refresh Endpoint origin validation (EUVD-2025-201507)
A vulnerability was found in Langflow up to 1.6.9 and classified as critical. This affects an unknown part of the component Refresh Endpoint. Executing a manipulation can lead to origin validation error.
The identification of this vulnerability is CVE-2025-34291. The attack may be launched remotely. Furthermore, there is an exploit available.
OSV
Langflow CORS misconfiguration enables Account Takeover and RCE
osv·2025-12-06
CVE-2025-34291 [CRITICAL] Langflow CORS misconfiguration enables Account Takeover and RCE
Langflow CORS misconfiguration enables Account Takeover and RCE
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
GHSA
Langflow CORS misconfiguration enables Account Takeover and RCE
ghsa·2025-12-06
CVE-2025-34291 [CRITICAL] CWE-346 Langflow CORS misconfiguration enables Account Takeover and RCE
Langflow CORS misconfiguration enables Account Takeover and RCE
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
VulnCheck
langflow langflow Origin Validation Error
vulncheck·2025·CVSS 9.4
CVE-2025-34291 [CRITICAL] langflow langflow Origin Validation Error
langflow langflow Origin Validation Error
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Affected: langflow langflow
Requi
CISA
Langflow Origin Validation Error Vulnerability
cisa·2026-05-21·CVSS 9.4
CVE-2025-34291 [CRITICAL] CWE-346 Langflow Origin Validation Error Vulnerability
Vulnerability: Langflow Origin Validation Error Vulnerability
Affected: Langflow Langflow
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability could affect an open-source component,
No detection rules found.
Nuclei
Langflow AI <= 1.6.9 - CORS Misconfiguration
nuclei·CVSS 9.4
CVE-2025-34291 [CRITICAL] Langflow AI <= 1.6.9 - CORS Misconfiguration
Langflow AI <= 1.6.9 - CORS Misconfiguration
Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint.
Template:
id: CVE-2025-34291
info:
name: Langflow AI <= 1.6.9 - CORS Misconfiguration
author: 686f6c61
severity: critical
description: |
Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint.
impact: |
An attacker can steal authenti
Hackernews
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
blogs_hackernews·2026-07-08·CVSS 10.0
CVE-2026-48282 [CRITICAL] CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2026-48282 (CVSS score: 10.0) - A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary code execution in the context of the current user.
CVE-2026-56290 (CVSS score: 10.0) - An improper access control vulnerability in Joomlack Page Builder that could allow for remote code execution via unaut
Hackernews
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
blogs_hackernews·2026-07-07
CVE-2025-52691 Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
An Iranian hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS) has been wielding a previously undocumented modular command-and-control (C2) framework dubbed Cavern (aka Cav3rn) targeting Israeli organizations.
The activity, which has primarily singled out IT providers and government sectors, has been attributed to a threat cluster tracked by Check Point Research under the moniker Cavern Manticore , which it said shares some level of tactical overlaps with MuddyWater and Lyceum , the latter of which is assessed to be
Hackernews
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
blogs_hackernews·2026-06-10·CVSS 8.8
CVE-2026-5027 [HIGH] Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to findings from VulnCheck.
The vulnerability in question is CVE-2026-5027 (CVSS score: 8.8), a case of path traversal that could allow an attacker to write files to arbitrary locations.
"The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the fi
Hackernews
CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
blogs_hackernews·2026-05-22·CVSS 9.4
CVE-2025-34291 [CRITICAL] CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerabilities in question are listed below -
CVE-2025-34291 (CVSS score: 9.4) - An origin validation error vulnerability in Langflow that could allow an attacker to execute arbitrary code and achieve full system compromise.
CVE-2026-34926 (CVSS score: 6.7) - A directory traversal vulnerability in on-prem
https://github.com/langflow-ai/langflowhttps://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platformhttps://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rcehttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291https://www.crowdsec.net/vulntracking-report/cve-2025-34291
2025-12-05
Published
2026-05-21
Added to CISA KEV
Exploited in the wild