Langflow · Langflow
Langflow versions up to and including 1.6.9 contain an origin validation flaw, stemming from an overly permissive CORS configuration combined with a SameSite=None refresh token cookie, that lets cross-origin requests from a malicious webpage carry credentials. An attacker who can get a victim to load a page they control, with the victim's Langflow session active, can obtain fresh access and refresh tokens and use them to reach authenticated endpoints, including built-in code-execution functionality, to run arbitrary code on the system.
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
First seen exploited 49 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in langflow over 15 months. The latest fix listed for langflow is 1.7.1.
Cross-origin web request exploits exposed application endpoint
An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session
Built-in code execution functionality yields arbitrary command execution
allowing the attacker to execute arbitrary code and achieve full system compromise
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: langflow.
Upgrade to 1.10.3 or later
Fixes this CVE and 12 other known vulnerabilities in this package (CVE-2024-37014, CVE-2025-3248, +10).
pip install "langflow>=1.10.3"First fixed in 1.7.0 for CVE-2025-34291.
| If you run | Upgrade to |
|---|---|
| All versions before 1.7.0 | 1.10.3first fix for this CVE: 1.7.0 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2025-34291 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.