CVE-2025-34291: Langflow Origin Validation Error Vulnerability
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
Overview
Langflow, an open-source AI workflow platform, contains a chained origin validation flaw in versions through 1.6.9 that allows a malicious webpage to steal authenticated session tokens and then execute arbitrary code on the server. The root cause is a CORS configuration that accepts credentialed cross-origin requests from any origin, combined with a refresh token cookie set to SameSite=None, giving an attacker's page full access to the token refresh endpoint. Successful exploitation yields complete account takeover, remote code execution, and exposure of all API keys and credentials stored in the workspace.
Vulnerability details
Langflow's FastAPI backend is configured with allow_origins='*' and allow_credentials=True simultaneously, a combination that browsers treat as permission to send cookies on cross-origin requests to any destination. The refresh token cookie compounds this by carrying SameSite=None, which instructs the browser to attach it even on requests initiated from a third-party page. Together these settings eliminate the same-origin boundary that normally prevents one site from reading another site's authenticated responses, placing the flaw squarely in CWE-346: the server accepts inbound credentialed requests without validating that the origin is trusted.
When a victim with an active Langflow session visits an attacker-controlled webpage, that page issues a cross-origin request to the Langflow token refresh endpoint. The browser automatically attaches the victim's refresh token cookie, and Langflow returns fresh access and refresh tokens to the attacker's origin. The attacker then uses those tokens against authenticated endpoints, including built-in code-execution functionality, to run arbitrary code and achieve full system compromise. All API keys and downstream service credentials stored in the workspace are also exposed. Exploitation requires only that the victim visit a malicious page while logged in.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review Langflow access logs for token refresh requests where the Origin or Referer header does not match your organization's known Langflow hostname. Legitimate browser sessions should originate from the same host; a foreign origin on a refresh call is a strong indicator of exploitation.
- Audit authentication logs for access token issuance events that are immediately followed by calls to code-execution or flow-execution endpoints from a different IP address or user-agent than the session that originally authenticated, indicating token theft and reuse.
Remediation
Additional hardening
- Upgrade Langflow to version 1.9.3 or later, which addresses the permissive CORS configuration and cookie attribute issues present in all versions through 1.6.9.
- Restrict network access to the Langflow instance so it is reachable only from trusted internal networks or VPN-connected clients, preventing a victim's browser from reaching the server from an attacker-controlled page on the public internet.
- If immediate upgrade is not possible, configure a reverse proxy in front of Langflow to enforce an explicit allowlist of permitted Origin header values and reject credentialed cross-origin requests from unlisted origins.
- Rotate all API keys and third-party service credentials stored in any Langflow workspace that ran a vulnerable version, as successful exploitation exposes the full credential store to the attacker.
Key dates
References
- https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform
- https://github.com/langflow-ai/langflow
- https://github.com/langflow-ai/langflow/releases/tag/v1.9.3
- https://github.com/langflow-ai/langflow/issues/11465#event-25774545848
- https://nvd.nist.gov/vuln/detail/CVE-2025-34291
- https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291
- https://www.crowdsec.net/vulntracking-report/cve-2025-34291
Frequently asked questions
Does CVE-2025-34291 affect my FedRAMP authorization?
If Langflow runs inside your authorization boundary, yes. CVE-2025-34291 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of June 4, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is visible to your assessor and sponsoring agency now. Your path forward is remediation or formal documentation of the mitigation and the delay.
How does Knox help me handle CVE-2025-34291?
Knox does not patch your software. Remediating Langflow is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix for your next assessment. Applying the patch is yours to own; maintaining a defensible compliance posture while you do it is not something you have to manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2025-34291 surfaces, exposure is identified through ongoing monitoring rather than surfacing for the first time during an assessor review. That gap matters when KEV deadlines are already running.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2025-34291's remediation deadline of June 4, 2026 has passed. What happens now?
If CVE-2025-34291 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
