CVE-2025-34291 — HIGH (CVSS 8.8) AI Security Vulnerability

Q: Is CVE-2025-34291 actively exploited?

Yes, CVE-2025-34291 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog.

Q: How to fix CVE-2025-34291?

1. PATCH: Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix. 2. NETWORK ISOLATION: If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure. 3. CORS HARDENING: Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True. 4. COOKIE FLAGS: Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion. 5. DETECT: Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers. 6. CREDENTIAL ROTATION: If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment. 7. DISABLE EXECUTION: If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

Q: What systems are affected by CVE-2025-34291?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow platforms, AI development environments, multi-tool AI pipelines, model serving.

Q: What is the CVSS score for CVE-2025-34291?

CVE-2025-34291 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 13.27%.

CISO Take

Any Langflow instance (≤1.6.9) exposed to the internet is a full system compromise waiting to happen — a single authenticated user visiting a malicious webpage hands the attacker RCE on your AI workflow server. Patch immediately or take Langflow offline; if patching is not possible, restrict it to VPN/internal network and enforce strict CORS policies. Given Langflow's built-in code execution and typical access to LLM API keys, vector stores, and downstream services, breach impact extends well beyond the Langflow host itself.

Risk Assessment

Critical operational risk despite CVSS 8.8 (High) rating. Attack complexity is low, no special privileges beyond a victim session are required, and exploitation follows a standard drive-by pattern requiring no AI/ML expertise. The built-in code execution endpoint eliminates any need for additional post-auth steps — one hop from token theft to full shell. EPSS of 13.1% indicates significant real-world exploitation interest. Not yet in CISA KEV but likely to be added if active exploitation is confirmed.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
langflow	pip	—	No patch
147.6K Pushed 6d ago 32% patched ~53d to patch Full package profile →
langflow	pip	<= 1.6.9	No patch
147.6K Pushed 6d ago 32% patched ~53d to patch Full package profile →

Severity & Risk

CVSS 3.1

8.8 / 10

EPSS

13.3%

chance of exploitation in 30 days

Higher than 94% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Actively Exploited

Sophistication

Trivial

Exploitation Confidence

high

✓ CISA KEV (active exploitation confirmed)

○ Public PoC indexed (trickest/cve)

○ Nuclei detection template available

○ EPSS exploit prediction: 13%

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

Recommended Action

7 steps

PATCH

Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix.
NETWORK ISOLATION

If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure.
CORS HARDENING

Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True.
COOKIE FLAGS

Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion.
DETECT

Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers.
CREDENTIAL ROTATION

If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment.
DISABLE EXECUTION

If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

CISA SSVC Assessment

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Auth Bypass Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0078 - Drive-by Compromise AML.T0091.000 - Application Access Token AML.T0106 - Exploitation for Credential Access

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system security A.6.1 - AI system design and development A.9.3 - Operation and monitoring of AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management MANAGE 2.2 - Mechanisms for AI risk treatment

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2025-34291?

Any Langflow instance (≤1.6.9) exposed to the internet is a full system compromise waiting to happen — a single authenticated user visiting a malicious webpage hands the attacker RCE on your AI workflow server. Patch immediately or take Langflow offline; if patching is not possible, restrict it to VPN/internal network and enforce strict CORS policies. Given Langflow's built-in code execution and typical access to LLM API keys, vector stores, and downstream services, breach impact extends well beyond the Langflow host itself.

Is CVE-2025-34291 actively exploited?

Yes, CVE-2025-34291 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog.

How to fix CVE-2025-34291?

1. PATCH: Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix. 2. NETWORK ISOLATION: If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure. 3. CORS HARDENING: Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True. 4. COOKIE FLAGS: Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion. 5. DETECT: Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers. 6. CREDENTIAL ROTATION: If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment. 7. DISABLE EXECUTION: If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

What systems are affected by CVE-2025-34291?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow platforms, AI development environments, multi-tool AI pipelines, model serving.

What is the CVSS score for CVE-2025-34291?

CVE-2025-34291 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 13.27%.

Technical Details

NVD Description

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Exploitation Scenario

Attacker registers a domain and hosts a malicious webpage containing JavaScript that silently fetches the victim organization's Langflow refresh endpoint (e.g., https://langflow.company.com/api/v1/refresh). Because Langflow is misconfigured with allow_origins='*' plus allow_credentials=True, and the refresh cookie carries SameSite=None, the browser automatically includes the victim's cookie in the cross-origin request. The server responds with a fresh access_token/refresh_token pair. The attacker's script immediately uses the stolen access token to call Langflow's code execution endpoint, running a Python reverse shell. The attacker now has persistent RCE, extracts LLM API keys from environment variables, and pivots to connected AI infrastructure — all without the victim performing any action beyond loading the malicious page while authenticated to Langflow.