Langflow CORS misconfiguration enables CSRF-driven token theft and RCE
Langflow ≤ 1.6.9: permissive CORS and SameSite=None cookies enable CSRF token theft, giving attackers RCE via authenticated endpoints. CVSS 8.8 high. CISA KEV 2026-05-21.
- Vendor
- Langflow
- Product
- Langflow
- CVSS
- 8.8
- EPSS (exploit probability)
- 83.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Langflow versions up to and including 1.6.9 contain a chained vulnerability enabling account takeover and remote code execution. Two misconfigurations combine: an overly permissive CORS policy (allow_origins='*' with allow_credentials=True) and a refresh token cookie set to SameSite=None. Together, these allow a malicious webpage to make cross-origin requests that include credentials and successfully call the refresh token endpoint.
An attacker-controlled origin can obtain fresh access_token / refresh_token pairs for a victim session. Those tokens grant access to authenticated endpoints in Langflow — including built-in code-execution functionality — enabling arbitrary code execution and full system compromise.
CISA added CVE-2025-34291 to the Known Exploited Vulnerabilities catalog on 2026-05-21. Source: NVD.
Affected versions
Langflow 1.6.9 and earlier.
What to do
Upgrade to a current Langflow 1.9.x release. This issue has been fixed in subsequent versions. Upgrading past 1.7.3 also addresses CVE-2026-0770 and CVE-2026-55255; upgrading to 1.9.0+ also addresses CVE-2026-33017. Upgrade to current rather than stopping at the minimum version that closes this specific CVE.
The attack requires a victim user to visit a malicious webpage while authenticated to Langflow. That’s a lower bar than it sounds in enterprise environments where credential sharing or phishing are already in scope.
