Langflow CORS misconfiguration enables CSRF-driven token theft and RCE
Langflow ≤ 1.6.9: permissive CORS and SameSite=None cookies enable CSRF token theft, giving attackers RCE via authenticated endpoints. CVSS 8.8 high. CISA KEV 2026-05-21.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 8.8
- EPSS (exploit probability)
- 92.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-34291 being exploited?
Yes. CISA added CVE-2025-34291 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 92.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
What to do
US federal civilian agencies must remediate by (14 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Langflow versions up to and including 1.6.9 contain a chained vulnerability enabling account takeover and remote code execution. Two misconfigurations combine: an overly permissive CORS policy (allow_origins='*' with allow_credentials=True) and a refresh token cookie set to SameSite=None. Together, these allow a malicious webpage to make cross-origin requests that include credentials and successfully call the refresh token endpoint.
An attacker-controlled origin can obtain fresh access_token / refresh_token pairs for a victim session. Those tokens grant access to authenticated endpoints in Langflow — including built-in code-execution functionality — enabling arbitrary code execution and full system compromise.
CISA added CVE-2025-34291 to the Known Exploited Vulnerabilities catalog on 2026-05-21. Source: NVD.
Affected versions
Langflow 1.6.9 and earlier.
What to do
Upgrade to a current Langflow 1.9.x release. This issue has been fixed in subsequent versions. Upgrading past 1.7.3 also addresses CVE-2026-0770 and CVE-2026-55255; upgrading to 1.9.0+ also addresses CVE-2026-33017. Upgrade to current rather than stopping at the minimum version that closes this specific CVE.
The attack requires a victim user to visit a malicious webpage while authenticated to Langflow. That’s a lower bar than it sounds in enterprise environments where credential sharing or phishing are already in scope.
Other Langflow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-105740 Authenticated RCE via MCP tool additionwrite-up | [ CRITICAL ] | 9.9 | 0.6% | — |
| CVE-2026-0768 Langflow Unauthenticated RCE via Code Execution Endpointwrite-up | [ CRITICAL ] | 9.8 | 22.9% | — |
| CVE-2026-0770 Langflow validate-endpoint exec_globals RCE (unauthenticated)write-up | [ CRITICAL ] | 9.8 | 62.6% | |
| CVE-2026-55255 Langflow /api/v1/responses IDOR — cross-user flow executionwrite-up | [ HIGH ] | 8.4 | 0.9% | |
| CVE-2026-33017 Langflow public flow build endpoint allows unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 24.8% | |
| CVE-2025-3248 Langflow unauthenticated code injection in validate/code endpointransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% |
