🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2025-34291

9.4

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Attack Vector

Network

Privileges Req.

None

User Interaction

langflow

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalMisconfiguration~10 seconds

Langflow AI <= 1.6.9 - CORS Misconfiguration

Langflow AI versions 1.6.9 and earlier are vulnerable to a CORS misconfiguration that allows any origin to make credentialed requests. Combined with SameSite=None cookies, this enables cross-origin token theft and subsequent remote code execution via the /api/v1/validate/code endpoint. References: https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform https://nvd.nist.gov/vuln/detail/CVE-2025-34291 https://github.com/langflow-ai/langflow Remediation: Upgrade to Langflow version 1.7.0 or later which restricts CORS origins properly.

10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: langflow

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →