CVE-2025-34291 Langflow Origin Validation Error
Attackers can hijack user sessions via CORS misconfiguration to steal tokens and execute arbitrary code on Langflow instances.
- Exploited in the wild
- Since 21 May 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-34291?
CVE-2025-34291 is a critical vulnerability in Langflow Langflow, published on 5 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Weakness: CWE-346
Which versions are affected by CVE-2025-34291?
3 open source packages ship an affected version, including langflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langflow PyPI | All versions | 1.7.0 |
langflow PyPI | All versions | 1.7.0 |
langflow PyPI | All versions | 1.7.0 |
Products include Langflow Langflow.
How do I fix CVE-2025-34291?
Upgrade langflow to 1.7.0 or later. US federal agencies must fix it by 4 Jun 2026.
Is CVE-2025-34291 being exploited?
Yes. Attackers have exploited CVE-2025-34291 in the wild since at least 21 May 2026.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Langflow Langflow
Sources
Also known as GHSA-577h-p2hh-v4mv, PYSEC-2025-78, ROOT-APP-PYPI-CVE-2025-34291.