CVE-2025-34291: 
Homebrew vulnerability analysis and mitigation

CVE-2025-34291 is an Origin Validation Error (CWE-346) vulnerability in Langflow, an AI agent workflow platform, affecting all versions up to and including 1.6.9. The flaw chains an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) with a refresh token cookie set to SameSite=None, enabling cross-origin credential theft and subsequent remote code execution. It was first published on December 5, 2025, and added to the CISA KEV catalog on May 21, 2026, with a due date of June 4, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 9.4 (Critical) (CISA KEV, Obsidian Security, Red Hat Advisory).

The root cause is classified as CWE-346 (Origin Validation Error), arising from two misconfigurations that compound each other: Langflow's CORS policy allows all origins (allow_origins='*') while simultaneously permitting credentials (allow_credentials=True), and the refresh token cookie is configured with SameSite=None. This combination allows a malicious webpage visited by an authenticated victim to issue cross-origin requests to Langflow's /refresh endpoint with the victim's cookies automatically included by the browser. The attacker's origin receives fresh access_token and refresh_token pairs in the response, which can then be used to authenticate to any Langflow endpoint — including built-in Python code-execution functionality — enabling full system compromise. A Nuclei detection template was developed and merged into the ProjectDiscovery repository, and a scanner PoC was published on GitHub (Obsidian Security, CISA KEV).

Successful exploitation allows an unauthenticated attacker (operating via a malicious webpage visited by an authenticated victim) to silently steal session tokens and escalate to full account takeover. With valid tokens, the attacker gains access to Langflow's authenticated API endpoints, including built-in code-execution components, enabling arbitrary command execution on the underlying server and complete system compromise. This can result in full confidentiality, integrity, and availability loss, with potential for lateral movement within the hosting environment and exfiltration of sensitive data processed by AI workflows (Obsidian Security, CISA KEV).

CVE-2025-34291 is actively exploited in the wild and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on May 21, 2026, with a federal remediation deadline of June 4, 2026 (CISA KEV). The Iranian state-sponsored threat actor MuddyWater has been attributed to exploitation campaigns leveraging this vulnerability, including reconnaissance scanning of approximately 12,000 systems targeting Middle East critical sectors (Cybersecurity News). A GitHub-hosted scanner (CVE-2025-34291-Langflow-Scanner) and Nuclei templates are publicly available, lowering the barrier to exploitation. The EPSS score is 0.000860 (low probability of exploitation in the next 30 days as of scoring date), though active exploitation has been confirmed independently of this metric. The vulnerability is not yet known to be used in ransomware campaigns per CISA (CISA KEV, Global Security Mag).

1. Reconnaissance: Identify internet-facing Langflow instances running version 1.6.9 or earlier using Shodan, Censys, or the public CVE-2025-34291-Langflow-Scanner tool. Confirm the target is accessible and requires authentication.
2. Lure victim: Craft a malicious webpage hosted on an attacker-controlled domain. The page must be visited by an authenticated Langflow user (e.g., via phishing email or watering hole attack).
3. Cross-origin token theft: The malicious page executes JavaScript that sends a cross-origin POST request to the victim's Langflow instance at the /api/v1/refresh endpoint. Because CORS is configured with allow_origins='*' and allow_credentials=True, and the refresh cookie is SameSite=None, the browser automatically includes the victim's refresh token cookie in the request, and the server returns a fresh access_token and refresh_token pair to the attacker's origin.
4. Token exfiltration: The attacker's JavaScript reads the JSON response containing the new tokens and transmits them to an attacker-controlled server.
5. Authenticated API access: Using the stolen access_token, the attacker authenticates to the Langflow API as the victim user.
6. Remote code execution: The attacker calls Langflow's built-in code-execution endpoint (e.g., the Python code component API) with a crafted payload to execute arbitrary system commands on the server, achieving full system compromise (Obsidian Security, CISA KEV).

• Network: Unexpected cross-origin requests to /api/v1/refresh from unfamiliar or external origins; outbound connections from the Langflow server to unknown external IPs following token refresh activity; unusual API calls to code-execution endpoints from IP addresses not associated with legitimate users.
• Logs: Langflow access logs showing POST /api/v1/refresh requests with Origin headers from domains not in the trusted list; rapid succession of token refresh events for a single user account from different IP addresses; API calls to code-execution endpoints immediately following anomalous token refresh events.
• File System: Unexpected files written to the Langflow working directory or system temp directories; new cron jobs, scheduled tasks, or persistence mechanisms created by the Langflow process user.
• Process: Unusual child processes spawned by the Langflow Python process (e.g., bash, sh, curl, wget, python, nc); reverse shell connections originating from the Langflow service account.
• Authentication: Multiple failed or successful token refresh attempts from geographically dispersed IPs for the same user session; access tokens used from IP addresses inconsistent with the user's normal access patterns (Obsidian Security, CISA KEV).

The primary remediation is to upgrade Langflow to version 1.9.3 or later, which addresses the CORS and SameSite misconfiguration (CISA KEV, Langflow GitHub). For organizations unable to patch immediately, the following configuration-based mitigations should be applied: (1) Restrict allow_origins to specific trusted domains rather than the wildcard '*'; (2) Set refresh token cookies to SameSite=Strict or SameSite=Lax; (3) Implement Content Security Policy (CSP) headers to restrict cross-origin requests. If mitigations cannot be applied, CISA recommends discontinuing use of the product. Federal agencies must remediate by June 4, 2026, per BOD 22-01 (CISA KEV).

CISA added CVE-2025-34291 to its KEV catalog on May 21, 2026, generating significant coverage across security media outlets including The Hacker News, Security Affairs, SC World, and Heise (The Hacker News, Security Affairs). Obsidian Security published the original technical disclosure, and the vulnerability was highlighted in the NCSC CTO weekly summary and Recorded Future's May 2026 CVE landscape report. Social media discussion on Mastodon, Bluesky, and Reddit was active around the KEV listing, with community members noting the severity of the CORS/SameSite chaining technique and its applicability to AI workflow platforms. The MuddyWater attribution added geopolitical significance, with researchers at Ctrl-Alt-Intel and Oasis Security documenting the Iranian APT's exploitation activity against Middle East critical infrastructure (Cybersecurity News, Global Security Mag).