Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-346.
Summary
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Langflow | Langflow | up to 1.6.9 | — | No fix listed | CNA |
| — | langflow (PyPI) | before 1.7.0 | 1.7.0 | Patch available | GHSA-577h-p2hh-v4mv |
- Langflow VendorLangflow Affected up to 1.6.9 Fixed in — No fix listed CNA
- langflow (PyPI) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-577h-p2hh-v4mv
Remediation
- Fix · GHSA-577h-p2hh-v4mv langflow (PyPI) Fixed in 1.7.0 Advisory →
Timeline
- 2026-05-21 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-34291
- 2026-10-03 Alias added: GHSA-577h-p2hh-v4mv
References
Advisory 2
Other 7
- https://github.com/langflow-ai/langflow
- https://github.com/langflow-ai/langflow/pull/10139
- https://github.com/langflow-ai/langflow/pull/10696
- https://github.com/langflow-ai/langflow/pull/9240
- https://github.com/langflow-ai/langflow/pull/9441
- https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-78.yaml
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291
More Langflow vulnerabilities
- TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
- TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
- TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
- TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
- TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
- TI-2026-22309 Langflow has Remote Code Execution in CSV Agent CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-34291 · CVE Program
- CVE-2025-34291 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-577h-p2hh-v4mv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences