Summary
CVE-2025-34291 is a high severity vulnerability affecting Langflow versions up to 1.6.9. A CORS misconfiguration and insecure cookie settings allow attackers to hijack authenticated user sessions and execute arbitrary code, leading to full system compromise. Public proof-of-concept code is available, and the issue is fixed in version 1.7.0.
Urgent Actions Required
- Upgrade Langflow to version 1.7.0 or later.
- Restrict CORS to trusted origins instead of allowing wildcard (*) origins
- Review and harden refresh token cookie settings where applicable.
- Rotate API keys, cloud credentials, and other sensitive tokens stored in affected Langflow workspaces if compromise is suspected.
- If immediate patching is not possible, restrict access to Langflow instances through trusted networks or a VPN and limit exposure to the public internet.
Which Systems Are Vulnerable to CVE-2025-34291?
Technical Overview
- Vulnerability Type: Chained Account Takeover and Remote Code Execution (RCE) caused by a CORS misconfiguration and origin validation error (CWE-346)
- Affected Software/Versions:
- Langflow versions up to and including 1.6.9
- CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2025-34291 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2025-34291?
Vulnerability Root Cause:
This vulnerability is caused by a combination of insecure CORS and session management configurations in Langflow. The application allows cross-origin requests from any origin while permitting credentials, and the refresh token cookie is configured with SameSite=None. As a result, a malicious website can send authenticated cross-origin requests to the refresh endpoint, obtain valid session tokens, and access authenticated features. These stolen tokens can then be used to abuse Langflow’s built-in code execution functionality, leading to remote code execution and full system compromise.
How Can You Mitigate CVE-2025-34291?
If immediate patching is delayed or not possible:
- Restrict CORS to trusted origins and avoid using wildcard (*) origins.
- Restrict access to Langflow instances through a VPN or trusted internal network if internet exposure is not required.
- Rotate API keys, cloud credentials, and other sensitive tokens stored in Langflow workspaces if compromise is suspected.
- Review application logs for unexpected requests to the /api/v1/validate/code endpoint and investigate unusual API activity.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- Langflow Instances - Running versions up to and including 1.6.9
- Self-hosted Langflow Deployments - Particularly those using the default CORS configuration
- Langflow Workspaces - Where API keys, access tokens, and other credentials are stored
- Business-Critical Systems at Risk:
- Cloud Environments - Where credentials stored in Langflow provide access
- SaaS Integrations - Connected services that rely on tokens or API keys stored in Langflow
- Databases and External Services - Systems accessed using credentials managed within Langflow
- Exposure Level:
- Internet-facing Langflow Instances - Especially those exposed to browsers with the default CORS configuration
- On-premises Langflow Deployments - Including deployments that authenticated users can access through a browser
Will Patching CVE-2025-34291 Cause Downtime?
Patch application impact: Low. Upgrading to Langflow 1.7.0 or later typically requires only a version update and service restart, resulting in minimal downtime.
Mitigation (if immediate patching is not possible): Restrict CORS to trusted origins, avoid wildcard (*) origins, and limit access to trusted networks until the upgrade can be completed.
How Can You Detect CVE-2025-34291 Exploitation?
Exploitation Signatures:
Monitor for unusual requests to the /api/v1/refresh endpoint and unexpected POST requests to /api/v1/validate/code from unusual origins.
Indicators of Compromise (IOCs/IOAs):
- Refresh token requests from unexpected IP addresses or geographic locations
- Access tokens used from multiple IP addresses within a short period
- Refresh token activity followed by code execution endpoint access
- Unexpected code execution or workflow execution requests
- Unusual API calls made using credentials stored in Langflow
Behavioral Indicators:
- Unusual activity on the /api/v1/refresh endpoint
- Unexpected code execution activity
- Elevated API request rates from a single session
- Session activity from different IP addresses
Alerting Strategy:
- Priority: Critical
- Trigger alerts for:
- Requests to /api/v1/refresh from unusual origins or IP addresses
- Unexpected access to code execution endpoints
- Session activity from multiple IP addresses
- Unauthorized workflow or code execution events
Remediation & Response
- Remediation Timeline:
- Immediate: Upgrade Langflow to version 1.7.0 or later
- Immediate: Restrict CORS to trusted origins
- Immediate: Rotate API keys, cloud credentials, and integration tokens if running Langflow ≤ 1.6.9
- Incident Response Considerations:
- Review logs for unexpected POST requests to /api/v1/validate/code
- Check /api/v1/refresh activity for suspicious requests
- Audit cloud provider logs for unauthorized API calls
- Review code execution logs for signs of unauthorized activity
See How XDR Helps You Identify, Prioritize, And Reduce Cyber Risk
-
-
- Learn how XDR calculates asset risk in real time
- Explore attack simulation for proactive defense
- Discover unified visibility across network, endpoint, cloud, and deception
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 8.8 | High-severity vulnerability with significant impact on affected systems |
| Attack Vector | Network | Can be exploited remotely over a network |
| Attack Complexity | Low | Exploitation does not require complex conditions |
| Privileges Required | Low | Requires access associated with a low-privileged account |
| User Interaction | None | The CVSS v3.1 assessment classifies the vulnerability as requiring no user interaction |
| Scope | Unchanged | The impact remains within the vulnerable component |
| Confidentiality Impact | High | Successful exploitation can expose sensitive information |
| Integrity Impact | High | Attackers can modify or execute unauthorized code |
| Availability Impact | High | Exploitation can significantly affect system availability |
References:
