CVE-2025-34291

Langflow versions up to and including 1.6.9 chain two web-security weaknesses - a permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh-token cookie set with SameSite=None - into account takeover and remote code execution. When an authenticated Langflow user visits an attacker-controlled webpage, the browser silently sends credentialed cross-origin requests that successfully call the refresh endpoint, letting the attacker mint fresh access_token/refresh_token pairs for the victim's session (CWE-346). With those tokens, the attacker can access authenticated endpoints, including Langflow's built-in code-execution functionality, and run arbitrary code for full system compromise. Any Langflow deployment at or below version 1.6.9 is affected, with internet-facing instances most exposed. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-21, and EPSS assigns an 83.6% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade Langflow to a release newer than 1.6.9 following vendor guidance, and invalidate existing sessions afterward. If patching must wait, correct the CORS configuration (do not combine allow_origins='*' with allow_credentials=True), stop marking the refresh-token cookie SameSite=None, and restrict internet exposure of the instance. Review access logs for refresh-endpoint calls from unexpected origins, rotate tokens and credentials for suspected victims, and follow BOD 22-01 requirements if you are a U.S. federal agency.