CVE-2025-34291
Langflow Origin Validation Error Vulnerability
Description
CVE-2025-34291 is a high-severity origin validation error in Langflow, a popular visual framework for building AI agent and workflow applications. The vulnerability chains an overly permissive CORS configuration (allow_origins='*' combined with allow_credentials=True) with a refresh-token cookie set to SameSite=None, allowing a malicious webpage to make credentialed cross-origin requests that hit the token refresh endpoint and harvest a victim's access and refresh tokens. With those tokens an attacker can reach authenticated endpoints — including Langflow's built-in code-execution functionality — to achieve account takeover and remote code execution, fully compromising the system. With a CVSS score of 8.8, an EPSS score in the 96th percentile, and a CISA KEV listing, CVE-2025-34291 demands immediate attention from anyone running Langflow.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| langflow | langflow | <= 1.6.9 |
References
- https://github.com/langflow-ai/langflow(Product)
- https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform(Exploit, Mitigation, Third Party Advisory)
- https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291(US Government Resource)
- https://www.crowdsec.net/vulntracking-report/cve-2025-34291(Third Party Advisory)
Weakness Type
CWE-346: Origin Validation Error
In Langflow, the origin validation error arises because the server accepts credentialed cross-origin requests from any origin (allow_origins='*' with allow_credentials=True), defeating the protection the same-origin policy would normally provide. Combined with a refresh-token cookie marked SameSite=None, this lets an attacker-controlled web page silently call the refresh endpoint in the victim's authenticated context and obtain fresh tokens.
Learn more: CWE-346 — Origin Validation Error
Impact Analysis
CVE-2025-34291 carries a CVSS 3.1 score of 8.8 (HIGH). It is remotely exploitable over the network with low attack complexity, requires only low privileges, and needs no user interaction beyond a victim visiting a malicious page while authenticated to Langflow, after which confidentiality, integrity, and availability are all fully compromised. The practical impact is severe: by stealing a victim's tokens the attacker gains account takeover, and because Langflow exposes built-in code-execution features to authenticated users, that account takeover escalates directly into remote code execution and full system compromise. With an EPSS score of 30.4% (96.8th percentile) and a CISA KEV listing, the likelihood of active exploitation is high and any internet-exposed Langflow instance should be considered an urgent priority.
Exploit Maturity
CVE-2025-34291 has a mature, well-documented exploit landscape. Public exploit details and proof-of-concept are available via Obsidian Security, with corroborating technical write-ups from VulnCheck and CrowdSec. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming exploitation concern, and the EPSS score of 30.4% (96.8th percentile) indicates a high probability of active exploitation. Because the attack chain — CORS misconfiguration to token hijack to RCE — is fully described publicly and Langflow is frequently deployed to expose AI workflow tooling, defenders should assume opportunistic exploitation is already underway.
Remediation
- Apply mitigations per vendor instructions as mandated by the CISA KEV deadline of 2026-06-04: upgrade Langflow beyond the affected range (versions up to and including 1.6.9 are vulnerable) to a release that hardens the CORS and cookie configuration.
- Correct the CORS policy so it does not combine allow_origins='*' with allow_credentials=True — restrict allowed origins to an explicit allowlist of trusted front-end domains.
- Set the refresh-token and session cookies to SameSite=Strict (or Lax) and ensure Secure and HttpOnly flags are applied, so attacker-controlled pages cannot trigger credentialed cross-origin requests to the refresh endpoint.
- Do not expose Langflow directly to the public internet without authentication and network controls; place it behind a VPN, reverse proxy with strict origin checks, or IP allowlist, given that authenticated access enables code execution.
- Review authentication and refresh-endpoint logs for cross-origin requests and token issuance from unexpected origins, rotate any potentially exposed tokens and credentials, and inspect for unauthorized flow definitions or code execution that may indicate a prior account takeover.
Technical Details
CVE-2025-34291 is an origin validation error (CWE-346) that manifests as a chained exploit in Langflow versions up to and including 1.6.9. The server's CORS configuration sets allow_origins='*' together with allow_credentials=True, which browsers will honor for credentialed requests, and the refresh-token cookie is configured with SameSite=None so it is sent on cross-site requests. An attacker hosts a malicious page; when an authenticated Langflow user visits it, the page issues a credentialed cross-origin request to the refresh endpoint, and the response — containing fresh access_token / refresh_token pairs — becomes readable to the attacker-controlled origin. Those tokens grant access to authenticated endpoints, including Langflow's built-in code-execution functionality, turning the token theft into arbitrary code execution and full system compromise. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack with high impact across all three security properties.
Frequently Asked Questions
Is CVE-2025-34291 being actively exploited?
CVE-2025-34291 is on the CISA Known Exploited Vulnerabilities catalog and has an EPSS score of 30.4% (96.8th percentile), indicating a high likelihood of exploitation. With public proof-of-concept details available from multiple security vendors, active exploitation should be assumed.
What products are affected by CVE-2025-34291?
The vulnerability affects Langflow versions up to and including 1.6.9. Any instance running these versions with the default permissive CORS configuration and SameSite=None refresh cookie is exposed.
How do I fix CVE-2025-34291?
Upgrade Langflow to a patched release beyond 1.6.9, and harden the configuration by replacing allow_origins='*' with an explicit origin allowlist and setting refresh/session cookies to SameSite=Strict with Secure and HttpOnly. Avoid exposing Langflow directly to the internet without additional access controls.
How severe is CVE-2025-34291?
CVE-2025-34291 is rated HIGH with a CVSS 3.1 score of 8.8. The chained CORS-to-token-hijack flaw enables account takeover that escalates to remote code execution through Langflow's built-in code-execution features, resulting in full system compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.