CVE-2025-34291 – Critical CORS Misconfiguration & Token Hijack Leading to RCE in Langflow

Key takeaways

• Severity: Critical (CVSS 9.4 v4.0, 8.8 v3.1)
• Impact: Account takeover & remote code execution via CORS + refresh‑token misuse.
• Affected: Langflow ≤ 1.6.9 (default permissive CORS settings).
• Status: Actively exploited; listed in CISA KEV (added 2026‑05‑21, patch by 2026‑06‑04 for federal agencies).
• Action: Apply vendor‑provided patch or harden CORS & cookie settings immediately.

Overview

On May 21 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-34291 to its Known Exploited Vulnerabilities (KEV) catalog, flagging it as a critical issue that must be mitigated by June 4 2026 for federal systems. The flaw resides in Langflow, an open‑source AI‑agent workflow platform, and enables a chained attack that leads to full system compromise.

The vulnerability stems from a misconfigured CORS policy (allow_origins='*' with allow_credentials=True) combined with a refresh‑token cookie set with SameSite=None. This combination allows a malicious web page hosted on any origin to make authenticated cross‑origin requests to the token‑refresh endpoint, steal fresh access‑token/refresh‑token pairs, and then invoke Langflow’s built‑in code‑execution API to run arbitrary commands on the server.

Technical Details

1. Overly permissive CORS – The server accepts requests from any origin while also allowing credentials (cookies, Authorization headers) to be sent. This violates the origin validation principle and is classified as CWE‑346.
2. Refresh‑token cookie mis‑configuration – The cookie used for token refresh is marked SameSite=None, permitting it to be sent on cross‑origin requests.
3. Token hijacking flow – An attacker‑controlled webpage can:
   • Issue a POST /refresh request to the vulnerable endpoint.
   • Receive a new access_token/refresh_token pair tied to the victim’s session.
4. Remote code execution – With the stolen tokens, the attacker can call Langflow’s internal code‑execution endpoint (e.g., /run, /execute) and execute arbitrary system commands, achieving full remote code execution on the host.

The attack requires only a malicious origin and does not need prior authentication beyond the victim’s active session, making it a high‑impact, low‑complexity exploit that is already observed in the wild (multiple active exploitation reports between 2026‑05‑21 and 2026‑05‑27).

Severity & Impact

The CVSS vectors reflect network‑accessible, low‑complexity attacks that result in complete confidentiality, integrity, and availability compromise.

Affected Products

• Vendor: Langflow
• Product: Langflow (AI workflow engine)
• Versions: ≤ 1.6.9 (any deployment using the default CORS configuration)

For a complete list of affected versions and CPE entries, see the live CVE page on VulnSocial: https://vulnsocial.com/cve/CVE-2025-34291.

Actionable Insights – What to Do Now

• Verify CORS settings – Ensure allow_origins lists only trusted domains. Remove the wildcard (*) if allow_credentials is required.
• Secure the refresh‑token cookie – Change SameSite=None to SameSite=Lax or Strict. If cross‑site usage is unnecessary, set SameSite=Strict.
• Rotate all existing tokens – Invalidate current access and refresh tokens to cut off any stolen credentials.
• Apply the vendor‑released patch (or upgrade to the first non‑vulnerable version, e.g., 1.7.0+). If a patch is unavailable, implement the manual hardening steps above.
• Restrict the token‑refresh endpoint – Limit access to internal networks or require additional authentication (e.g., CSRF token, MFA).
• Monitor for anomalous token activity – Log and alert on unexpected refresh calls, especially from unknown origins or IP ranges.
• Follow BOD 22‑01 guidance for cloud‑based deployments, as recommended by CISA for KEV‑listed services.

Remediation & Mitigation (Step‑by‑Step)

1. Upgrade – Deploy the latest Langflow release that disables the permissive CORS defaults.
2. If upgrade isn’t possible, edit the configuration:
   • Set allow_origins to an explicit whitelist of trusted domains.
   • Remove allow_credentials=True unless absolutely required.
   • Change the refresh‑token cookie attribute to SameSite=Lax or Strict.
3. Invalidate existing sessions – Force a logout for all users or programmatically revoke all active tokens.
4. Patch the code‑execution endpoint – If the endpoint is not needed, disable it or add additional authorization checks.
5. Implement network controls – Use firewall or API‑gateway rules to restrict access to the /refresh and code‑execution routes.
6. Enable detection – Deploy SIEM alerts for:
   • Cross‑origin POST /refresh requests.
   • Token issuance from unexpected origins.
   • Execution of code‑execution API calls without prior approval.
7. Document the change – Update your security policy to reflect the hardened CORS and cookie settings, and schedule regular reviews.

Bottom Line

CVE-2025-34291 is a critical flaw in Langflow that enables account takeover and remote code execution through a misconfigured CORS policy and insecure refresh‑token handling. Active exploitation has been confirmed and the vulnerability is now part of the CISA KEV catalog, with a hard deadline for remediation. Immediate patching or configuration hardening is essential to prevent full system compromise.

References

• https://github.com/langflow-ai/langflow
• https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform
• https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291
• https://www.crowdsec.net/vulntracking-report/cve-2025-34291

#CVE #CVE202534291 #Critical #RCE #CISAKEV #Langflow #AIsecurity #CORS #RemoteCodeExecution