{"advisories":[{"id":"GHSA-577h-p2hh-v4mv","source":"ghsa","title":"Langflow CORS misconfiguration enables Account Takeover and RCE","url":"https://github.com/advisories/GHSA-577h-p2hh-v4mv"}],"cve":"CVE-2025-34291","enrichment":{"created":"2025-12-08T09:39:54.653096+00:00","updated":"2025-12-08T09:39:54.653123+00:00","vendors":["langflow","langflow$PRODUCT$langflow"]},"epss":{"score":0.93216},"kev":{"dateAdded":"2026-05-21T00:00:00+00:00","dueDate":"2026-06-04T00:00:00+00:00"},"mitre":{"cpes":["cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"],"created":"2025-12-05T22:27:26.438000+00:00","description":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"mitre_repo_path":"cves/2025/34xxx/CVE-2025-34291.json","references":["https://github.com/langflow-ai/langflow","https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce"],"title":"Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE","updated":"2026-10-08T15:21:21.340000+00:00","vendors":["langflow","langflow$PRODUCT$langflow"],"weaknesses":["CWE-346"]},"nvd":{"cpes":["cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"],"created":"2025-12-05T23:15:47.433000+00:00","description":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2025/CVE-2025-34291.json","references":["https://github.com/langflow-ai/langflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291","https://www.crowdsec.net/vulntracking-report/cve-2025-34291","https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce"],"title":null,"updated":"2026-10-15T21:10:00.327000+00:00","vendors":["langflow","langflow$PRODUCT$langflow"],"weaknesses":["CWE-346"]},"opencve":{"changes":[{"created":"2025-12-05T22:45:00+00:00","data":[{"details":{"new":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","old":null},"type":"description"},{"details":{"new":"Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE","old":null},"type":"title"},{"details":{"added":["CWE-346"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://github.com/langflow-ai/langflow","https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV4_0":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"c0a5f8cc-cf6b-45ec-a698-97a9b74e7106"},{"created":"2025-12-08T21:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"29b01c10-aa78-4342-a4d0-e44bb6bb2a92"},{"created":"2025-12-09T10:15:00+00:00","data":[{"details":["langflow","langflow$PRODUCT$langflow"],"type":"first_time"},{"details":{"added":["langflow","langflow$PRODUCT$langflow"],"removed":[]},"type":"vendors"}],"id":"2246734c-5924-4ac3-8c94-8e189e8a41af"},{"created":"2026-01-16T21:30:00+00:00","data":[{"details":{"added":["cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":{"cvssV3_1":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"6e68a597-04f6-4f99-ba62-ea1bb8f0823d"},{"created":"2026-05-21T19:00:00+00:00","data":[{"details":{"added":{"kev":{"dateAdded":"2026-05-21T00:00:00+00:00","dueDate":"2026-06-04T00:00:00+00:00"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"204b64eb-0648-4b79-aebd-2318109a59bf"},{"created":"2026-05-21T20:30:00+00:00","data":[{"details":{"added":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291","https://www.crowdsec.net/vulntracking-report/cve-2025-34291"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"ssvc":{"new":{"options":{"Automatable":"no","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"},"old":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}}}},"type":"metrics"}],"id":"531a62d1-5aa1-4816-aa46-62d6f76b116f"}],"cpes":{"data":["cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2025-12-05T22:27:26.438000+00:00","provider":"mitre"},"description":{"data":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"provider":"nvd"},"cvssV4_0":{"data":{"score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},"provider":"mitre"},"epss":{"data":{"score":0.93216},"provider":"first"},"kev":{"data":{"dateAdded":"2026-05-21T00:00:00+00:00","dueDate":"2026-06-04T00:00:00+00:00"},"provider":"cisa"},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/langflow-ai/langflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291","https://www.crowdsec.net/vulntracking-report/cve-2025-34291","https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform","https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":"Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE","provider":"mitre"},"updated":{"data":"2026-05-21T20:16:13.520000+00:00","provider":"nvd"},"vendors":{"data":["langflow","langflow$PRODUCT$langflow"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-346"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-12-05T22:27:26.438000+00:00","description":"Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{"dateAdded":"2026-05-21"},"ssvc":{"options":{"Automatable":"no","Exploitation":"active","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34291","https://www.crowdsec.net/vulntracking-report/cve-2025-34291"],"title":"Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE","updated":"2025-12-08T20:46:41.309000+00:00","vendors":[],"vulnrichment_repo_path":"2025/34xxx/CVE-2025-34291.json","weaknesses":[]}}