CVE-2025-34291: Langflow security flaw enables

Q: Is CVE-2025-34291 actively exploited?

Yes, CVE-2025-34291 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Thu May 21 2026 00:00:00 GMT+0000 (Coordinated Universal Time).

Q: How to fix CVE-2025-34291?

1. PATCH: Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix. 2. NETWORK ISOLATION: If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure. 3. CORS HARDENING: Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True. 4. COOKIE FLAGS: Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion. 5. DETECT: Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers. 6. CREDENTIAL ROTATION: If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment. 7. DISABLE EXECUTION: If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

Q: What systems are affected by CVE-2025-34291?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow platforms, AI development environments, multi-tool AI pipelines, model serving.

Q: What is the CVSS score for CVE-2025-34291?

CVE-2025-34291 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 25.15%.

CISO Take

Any Langflow instance (≤1.6.9) exposed to the internet is a full system compromise waiting to happen — a single authenticated user visiting a malicious webpage hands the attacker RCE on your AI workflow server. Patch immediately or take Langflow offline; if patching is not possible, restrict it to VPN/internal network and enforce strict CORS policies. Given Langflow's built-in code execution and typical access to LLM API keys, vector stores, and downstream services, breach impact extends well beyond the Langflow host itself.

What is the risk?

Critical operational risk despite CVSS 8.8 (High) rating. Attack complexity is low, no special privileges beyond a victim session are required, and exploitation follows a standard drive-by pattern requiring no AI/ML expertise. The built-in code execution endpoint eliminates any need for additional post-auth steps — one hop from token theft to full shell. EPSS of 13.1% indicates significant real-world exploitation interest. Not yet in CISA KEV but likely to be added if active exploitation is confirmed.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
149.9K Pushed 3d ago 40% patched ~67d to patch Full package profile →
Langflow	pip	<= 1.6.9	`1.7.0`
149.9K Pushed 3d ago 40% patched ~67d to patch Full package profile →

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

25.2%

chance of exploitation in 30 days

Higher than 98% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Actively Exploited

CISA KEV

Sophistication

Trivial

Exploitation Confidence

high

✓ CISA KEV (active exploitation confirmed) — May 2026

✓ CISA SSVC: Active exploitation

○ Public PoC indexed (trickest/cve)

○ Nuclei detection template available

○ EPSS exploit prediction: 25%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

7 steps

PATCH

Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix.
NETWORK ISOLATION

If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure.
CORS HARDENING

Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True.
COOKIE FLAGS

Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion.
DETECT

Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers.
CREDENTIAL ROTATION

If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment.
DISABLE EXECUTION

If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

What does CISA's SSVC say?

Decision Act

Exploitation active

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0078 - Drive-by Compromise AML.T0091.000 - Application Access Token AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity Article 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment 8.4 - AI system security A.6.1 - AI system design and development A.9.3 - Operation and monitoring of AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk management MANAGE 2.2 - Mechanisms for AI risk treatment

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

How many AI incidents are linked? (1)

Langflow vulnerability (CVE-2025-34291) actively exploited in the wild

May 2026 Langflow code execution high confidence

CISA added CVE-2025-34291, an origin validation error in the Langflow AI workflow platform, to its Known Exploited Vulnerabilities catalog after confirming evidence of active exploitation.

The Hacker News

AI Threat Alert incident classification, derived from public security reporting. Each item links to its original source.

Frequently Asked Questions

What is CVE-2025-34291?

Any Langflow instance (≤1.6.9) exposed to the internet is a full system compromise waiting to happen — a single authenticated user visiting a malicious webpage hands the attacker RCE on your AI workflow server. Patch immediately or take Langflow offline; if patching is not possible, restrict it to VPN/internal network and enforce strict CORS policies. Given Langflow's built-in code execution and typical access to LLM API keys, vector stores, and downstream services, breach impact extends well beyond the Langflow host itself.

Is CVE-2025-34291 actively exploited?

Yes, CVE-2025-34291 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Thu May 21 2026 00:00:00 GMT+0000 (Coordinated Universal Time).

How to fix CVE-2025-34291?

1. PATCH: Upgrade Langflow beyond 1.6.9 — review PRs #9240, #10139, #10696 on GitHub for confirmed fix. 2. NETWORK ISOLATION: If patch is unavailable, immediately restrict Langflow to VPN or internal network; remove all public internet exposure. 3. CORS HARDENING: Override CORS configuration to explicit allowed origins — never combine allow_origins='*' with allow_credentials=True. 4. COOKIE FLAGS: Set refresh token cookie to SameSite=Strict or SameSite=Lax to prevent cross-site inclusion. 5. DETECT: Monitor logs for refresh endpoint calls (e.g., /api/v1/refresh) with unexpected or missing Origin headers. 6. CREDENTIAL ROTATION: If exposure was possible, rotate all API keys and secrets accessible from the Langflow environment. 7. DISABLE EXECUTION: If built-in code execution is not operationally required, disable or firewall those endpoints at the reverse proxy level.

What systems are affected by CVE-2025-34291?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow platforms, AI development environments, multi-tool AI pipelines, model serving.

What is the CVSS score for CVE-2025-34291?

CVE-2025-34291 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 25.15%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow platformsAI development environmentsmulti-tool AI pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0072 Reverse Shell

AML.T0078 Drive-by Compromise

AML.T0091.000 Application Access Token

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15, Article 9

ISO 42001: 6.1.2, 8.4, A.6.1, A.9.3

NIST AI RMF: GOVERN 6.1, MANAGE 2.2

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Exploitation Scenario

Attacker registers a domain and hosts a malicious webpage containing JavaScript that silently fetches the victim organization's Langflow refresh endpoint (e.g., https://langflow.company.com/api/v1/refresh). Because Langflow is misconfigured with allow_origins='*' plus allow_credentials=True, and the refresh cookie carries SameSite=None, the browser automatically includes the victim's cookie in the cross-origin request. The server responds with a fresh access_token/refresh_token pair. The attacker's script immediately uses the stolen access token to call Langflow's code execution endpoint, running a Python reverse shell. The attacker now has persistent RCE, extracts LLM API keys from environment variables, and pivots to connected AI infrastructure — all without the victim performing any action beyond loading the malicious page while authenticated to Langflow.