CVE-2025-34291

The application is configured with an overly permissive CORS policy (allow_origins='*' with allow_credentials=True), which is an incorrect combination — the browser should block such requests, however an implementation error enables their execution. At the same time, the refresh token cookie is configured with the SameSite=None flag, which allows a malicious website to send cross-origin requests containing credentials. An attacker can trick a victim into visiting a website controlled by the attacker, which calls the token refresh endpoint, thereby obtaining access_token / refresh_token pairs for the victim's session. The obtained tokens enable access to authenticated endpoints, including the built-in code execution functionality, leading to the execution of arbitrary code on the server.

An attacker can hijack the session of an authenticated user and then leverage the code execution mechanisms built into Langflow to execute arbitrary commands on the server and achieve full system compromise (complete control over the server and potentially over connected resources).

Apply patches available from the vendor according to the references. As a workaround, it is recommended to immediately correct the CORS configuration — remove the combination of allow_origins='*' with allow_credentials=True — and change the SameSite flag for the refresh token cookie to Strict or Lax.

Langflow versions up to and including 1.6.9 (Langflow-ai/Langflow)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.