Actively exploited in the wild
Langflow Origin Validation Error Vulnerability
Langflow - Langflow · Listed in the CISA KEV since 2026-05-21. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-34291
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
Risk Assessment
The risk for the organization includes complete user account takeover and remote code execution on the server, potentially leading to data theft, service disruption, and further escalation within the infrastructure.
Recommendation
Immediately upgrade Langflow to version 1.6.10 or later, which contains the fix. Additionally, restrict allowed origins in the CORS configuration and set SameSite to Lax or Strict for authentication cookies.
Original NVD description (English source)
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.