Langflow CORS Token Hijack to RCE
- Product
- Langflow Langflow
- CVE
- CVE-2025-34291
- Disclosed
- 2025-12-05
- CVSS
- 8.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Langflow <= 1.6.9
- Fixed
- Releases after 1.6.9 (upgrade to latest)
Summary
A drive-by chain found by Obsidian Security: simply visiting a malicious web page while logged in to Langflow lets the attacker steal the session and then use Langflow's built-in code execution. It was added to CISA KEV in May 2026.
Root cause
Langflow shipped CORS with allow_origins='*' together with allow_credentials=True, and its refresh-token cookie was SameSite=None. A cross-origin page could therefore call the token refresh endpoint with the victim's cookie and read back fresh access/refresh tokens. Those tokens grant access to authenticated features that execute arbitrary Python by design.
Impact
Account takeover and remote code execution on the Langflow server after a single page visit by a logged-in user.
Detection
Look for /api/v1/refresh requests carrying a foreign Origin header, followed by flow creation or code validation calls from new IPs. Version check: <= 1.6.9.
Mitigation
Upgrade Langflow, restrict CORS origins, and keep the UI on a private network.