Langflow versions up to and including 1

CVE-2025-34291 is a *chain*, not a single bug: Langflow's default CORS posture (LANGFLOW_CORS_ORIGINS=* with credentials allowed), a cross-site refresh-token cookie posture, and a refresh flow without meaningful CSRF resistance let an attacker-controlled website mint fresh tokens for a victim's existing Langflow session. Those tokens can then be used against authenticated endpoints, including Langflow's code-validation path, turning a browser-origin bug into full server-side code execution. Authoritative metadata from NVD/GHSA says affected versions are Langflow up to and including 1.6.9.

The vendor's HIGH 8.8 is directionally right, but the v3 vector hides the real shape of the attack. This is *not* a clean unauthenticated socket-level RCE you can spray across the internet; it needs a reachable Langflow instance, unsafe CORS/cookie behavior, and a logged-in victim browser. That friction pushes it down from CRITICAL in real enterprise operations, but KEV status, observed exploitation, and Langflow's habit of storing high-value API keys drag it right back to the top of the HIGH bucket.

Why this verdict

• Downward pressure: requires a live user session and browser interaction — the attacker needs a victim already authenticated to Langflow and able to reach the instance, which narrows reach versus true unauthenticated RCE.
• Downward pressure: exposed population is smaller than generic CVSS implies — only deployments with reachable Langflow plus unsafe CORS/cookie settings are in play, and many enterprises should already have these tools behind a proxy or dev network boundary.
• Upward pressure: KEV plus real campaigns outweigh the friction — exploitation has been observed since 2026-01-23, CISA added it to KEV on 2026-05-21, and the post-exploitation blast radius is unusually high because Langflow stores reusable API keys and executes code by design.

Why not higher?

I am not calling this CRITICAL because the exploit chain is not a clean, unauthenticated network RCE. It depends on a victim browser, a valid session, and a reachable instance with unsafe defaults, which means reachability and reliability are materially lower than something like a one-request pre-auth service exploit.

Why not lower?

I am not dropping this to MEDIUM because the end state is still full code execution and likely secret theft, not a narrow account-only issue. KEV listing and observed exploitation remove the usual benefit of the doubt; attackers are already proving the chain works in real environments.

1. Disable credentialed cross-origin requests — Set LANGFLOW_CORS_ALLOW_CREDENTIALS=False immediately where operationally possible. Because this CVE is KEV-listed/actively exploited, deploy this within hours; it severs the easiest token-theft leg of the chain while patching is organized.
2. Replace wildcard origins with an explicit allowlist — Set LANGFLOW_CORS_ORIGINS to only the exact frontend origins that must talk to Langflow. Do this within hours for exposed instances; wildcard origins are the hinge that makes the browser side of the exploit cheap.
3. Put Langflow behind a real access boundary — Move exposed instances behind a reverse proxy with authentication, network ACLs, or VPN/identity-aware proxy controls so arbitrary internet traffic cannot reach the app directly. For this KEV item, do it within hours for any internet-facing deployment that cannot be patched immediately.
4. Rotate stored secrets after suspected exposure — If an instance was internet-reachable or handled untrusted user browsing since 2026-01-23, assume workspace secrets may be burned and rotate Langflow-held API keys, cloud tokens, and database credentials. Start within hours on exposed/high-value instances because patching does not un-leak already stolen tokens.
5. Monitor and alert on refresh and code-validation abuse — Create detections for unusual /api/v1/refresh traffic, unexpected Origin headers, and follow-on calls to /api/v1/validate/code or build endpoints from new IPs/user agents. Stand this up within hours for exposed instances to catch replay and post-exploitation while remediation proceeds.

Run this on the Langflow host or inside the Langflow container. Invoke it as bash verify_cve_2025_34291.sh /path/to/.env (example: docker exec langflow bash /tmp/verify_cve_2025_34291.sh /app/.env). It needs only local read access to the installed langflow package metadata and, if provided, the Langflow .env file; root is not required unless app files are restricted.

#!/usr/bin/env bash
# verify_cve_2025_34291.sh
# Detect likely exposure state for CVE-2025-34291 on a Langflow host/container.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown

set -u

ENV_FILE="${1:-}"
VERSION=""
CORS_ORIGINS=""
CORS_ALLOW_CREDENTIALS=""
STATUS="UNKNOWN"
REASON=""

trim() {
  local s="$1"
  s="${s#${s%%[![:space:]]*}}"
  s="${s%${s##*[![:space:]]}}"
  printf '%s' "$s"
}

norm_bool() {
  local v
  v="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
  case "$v" in
    true|1|yes|y|on) printf 'true' ;;
    false|0|no|n|off) printf 'false' ;;
    *) printf '' ;;
  esac
}

verlte() {
  # returns 0 if $1 <= $2
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

vergte() {
  # returns 0 if $1 >= $2
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

load_env_file() {
  local f="$1"
  [ -f "$f" ] || return 0
  while IFS='=' read -r k v; do
    k="$(trim "$k")"
    v="$(trim "$v")"
    [ -z "$k" ] && continue
    case "$k" in
      \#*) continue ;;
      export\ *) k="${k#export }" ;;
    esac
    v="${v%\r}"
    v="${v%\"}"
    v="${v#\"}"
    v="${v%\'}"
    v="${v#\'}"
    case "$k" in
      LANGFLOW_CORS_ORIGINS) CORS_ORIGINS="$v" ;;
      LANGFLOW_CORS_ALLOW_CREDENTIALS) CORS_ALLOW_CREDENTIALS="$v" ;;
    esac
  done < "$f"
}

get_version() {
  if command -v python3 >/dev/null 2>&1; then
    VERSION="$(python3 - <<'PY' 2>/dev/null
from importlib import metadata
try:
    print(metadata.version('langflow'))
except Exception:
    pass
PY
)"
  fi

  if [ -z "$VERSION" ] && command -v pip >/dev/null 2>&1; then
    VERSION="$(pip show langflow 2>/dev/null | awk -F': ' '/^Version: /{print $2; exit}')"
  fi

  if [ -z "$VERSION" ] && command -v pip3 >/dev/null 2>&1; then
    VERSION="$(pip3 show langflow 2>/dev/null | awk -F': ' '/^Version: /{print $2; exit}')"
  fi
}

# Prefer explicit env file if provided, otherwise fall back to current environment.
if [ -n "$ENV_FILE" ]; then
  load_env_file "$ENV_FILE"
fi

[ -z "$CORS_ORIGINS" ] && CORS_ORIGINS="${LANGFLOW_CORS_ORIGINS:-}"
[ -z "$CORS_ALLOW_CREDENTIALS" ] && CORS_ALLOW_CREDENTIALS="${LANGFLOW_CORS_ALLOW_CREDENTIALS:-}"

CORS_ALLOW_CREDENTIALS="$(norm_bool "$CORS_ALLOW_CREDENTIALS")"
get_version

RISKY_CORS="false"
if [ "${CORS_ORIGINS}" = "*" ] && [ "${CORS_ALLOW_CREDENTIALS}" = "true" ]; then
  RISKY_CORS="true"
fi

if [ -n "$VERSION" ]; then
  if verlte "$VERSION" "1.6.9"; then
    STATUS="VULNERABLE"
    REASON="Installed langflow version $VERSION is within authoritative affected range (<= 1.6.9)."
  elif vergte "$VERSION" "1.9.3"; then
    STATUS="PATCHED"
    REASON="Installed langflow version $VERSION is at or above the documented security target 1.9.3."
    if [ "$RISKY_CORS" = "true" ]; then
      REASON="$REASON Warning: CORS is still configured as wildcard + credentials, which is dangerous even if this CVE is patched."
    fi
  else
    STATUS="UNKNOWN"
    REASON="Installed langflow version $VERSION is newer than 1.6.9 but below 1.9.3; public advisories are inconsistent on the exact fixed boundary."
    if [ "$RISKY_CORS" = "true" ]; then
      REASON="$REASON Risky CORS configuration is also present."
    fi
  fi
else
  STATUS="UNKNOWN"
  REASON="Could not determine installed langflow version from python package metadata."
  if [ "$RISKY_CORS" = "true" ]; then
    REASON="$REASON Risky CORS configuration (wildcard origins + credentials) is present."
  fi
fi

printf '%s\n' "$STATUS"
printf '%s\n' "$REASON"

case "$STATUS" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. NVD CVE-2025-34291
2. GitHub Advisory GHSA-577h-p2hh-v4mv
3. Obsidian Security technical write-up
4. CrowdSec exploitation report
5. Cloud Security Alliance research note
6. Langflow authentication and CORS documentation
7. Langflow validate-code endpoint documentation
8. Censys Langflow exposure advisory