CVE-2025-34291
📋 TL;DR
This vulnerability in Langflow allows attackers to hijack user sessions through a CORS misconfiguration, leading to account takeover and remote code execution. Attackers can steal refresh tokens from victim sessions and use them to execute arbitrary code on the system. All Langflow deployments up to version 1.6.9 are affected.
💻 Affected Systems
- Langflow
📦 What is this software?
Langflow by Langflow
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where attacker gains complete control over the Langflow instance, executes arbitrary code, accesses sensitive data, and potentially pivots to other systems.
Likely Case
Account takeover leading to unauthorized access to Langflow workflows, data exfiltration, and potential code execution within the application context.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the Langflow application itself.
🎯 Exploit Status
Exploitation requires a victim to visit a malicious website while authenticated to Langflow. The attack chain is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.10 and later
Vendor Advisory: https://github.com/langflow-ai/langflow/security/advisories
Restart Required: Yes
Instructions:
1. Update Langflow to version 1.6.10 or later. 2. Restart the Langflow service. 3. Verify the CORS configuration now properly restricts origins.
🔧 Temporary Workarounds
Restrict CORS Origins
allManually configure CORS to only allow trusted origins instead of wildcard (*)
Edit Langflow configuration to set allow_origins to specific trusted domains instead of '*'
Set allow_credentials=False if possible
Network Segmentation
allRestrict access to Langflow to trusted networks only
Configure firewall rules to only allow access from trusted IP ranges
Use VPN or zero-trust access for remote users
🧯 If You Can't Patch
- Isolate Langflow instance behind a reverse proxy that enforces proper CORS headers
- Implement strict SameSite cookie policies and consider using HttpOnly flags for sensitive cookies
🔍 How to Verify
Check if Vulnerable:
Check Langflow version and inspect CORS configuration for allow_origins='*' with allow_credentials=TrueCheck Version:
langflow --version or check package version in Python: pip show langflowVerify Fix Applied:
Verify version is 1.6.10+ and test that cross-origin requests with credentials are properly rejected📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from unusual origins
- Unusual refresh token usage patterns
- Code execution attempts from unexpected user accounts
Network Indicators:
- Cross-origin requests to /api/v1/refresh endpoint
- Requests with Origin headers from untrusted domains
SIEM Query:
source="langflow" AND (uri_path="/api/v1/refresh" OR status_code=401) | stats count by src_ip, user_agent