CVE-2025-34291
Published: 05 December 2025
Description
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage…
more
to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Mitigating Controls (NIST 800-53 r5)AI
Requires establishment of secure configuration settings for web applications, directly mitigating the permissive CORS (allow_origins='*') and unsafe SameSite=None cookie configurations exploited in this CVE.
Mandates timely flaw remediation including patching Langflow to versions beyond 1.6.9, eliminating the chained vulnerability enabling token theft and RCE.
Enforces boundary protections such as web application firewalls or proxies to monitor and restrict unauthorized cross-origin credentialed requests to the refresh endpoint.
Security SummaryAI
CVE-2025-34291 is a chained vulnerability in Langflow versions up to and including 1.6.9 that enables account takeover and remote code execution. It stems from an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) paired with a refresh token cookie set as SameSite=None. This combination allows cross-origin requests with credentials from malicious webpages to successfully invoke the refresh endpoint, enabling attackers to steal fresh access and refresh tokens from victim sessions. The vulnerability is rated at CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H) and is associated with CWE-346.
The attack requires a victim to visit a malicious webpage controlled by the attacker, which can be delivered via phishing or social engineering. Once loaded, the page performs cross-origin requests including the victim's credentials to the Langflow refresh endpoint, obtaining valid access_token and refresh_token pairs. With these tokens, the attacker gains access to authenticated endpoints, including built-in code-execution functionality, allowing arbitrary code execution and full system compromise. Exploitation requires low privileges (PR:L) as it leverages an existing authenticated user session.
Advisories from Obsidian Security, VulnCheck, and the Langflow GitHub repository detail the issue and recommend mitigation. Security practitioners should consult these sources for patch information, as Langflow versions beyond 1.6.9 address the CORS and cookie misconfigurations.
Langflow is an AI agent workflow platform, making this vulnerability particularly relevant for deployments involving AI/ML workflows where code execution endpoints could expose sensitive models or data. No public evidence of real-world exploitation is noted in available details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of public-facing web application (T1190) via phishing-delivered malicious webpage (T1566.002) to steal application access/refresh tokens (T1528), leading to account takeover and RCE.