Skip to content
Log inStart free trial

GHSA-577h-p2hh-v4mv CVE-2025-34291 PYSEC-2025-78

Langflow CORS misconfiguration enables Account Takeover and RCE

Critical Known exploited PyPI
Severity
9.4 / 10
Critical · CVSS 4.0
Exploit chance (EPSS)
92.81%
Chance of exploitation in the next 30 days. Higher than 99.83% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since May 21, 2026
Weakness
CWE-346 Origin Validation Error
Fix
1.7.0
Upgrade langflow to this version or later
Exploited in the wild. Langflow Origin Validation Error Vulnerability (Langflow Langflow). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Jun 4, 2026.

Description

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Affected versions

PyPI

PackageVulnerableFixed in
langflow
<= 1.6.9
 No fix yet
langflow
< 1.7.0
1.7.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

langflow PyPI → 1.7.0

pip
pip install --upgrade "langflow>=1.7.0"
poetry
poetry add "langflow>=1.7.0"
uv
uv add "langflow>=1.7.0"

Severity breakdown

CVSS 4.0 9.4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
User interaction
Passive
Confidentiality (vulnerable system)
High
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
High
Integrity (subsequent systems)
High
Availability (subsequent systems)
High

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-346: Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References

Advisories

Fixes and patches

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-qrpv-q767-xqq2
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
High Known exploited Also affects langflow
GHSA-vwmf-pq79-vjvx
Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint
Critical Known exploited Also affects langflow
GHSA-g22f-v6f7-2hrh
Langflow affected by Remote Code Execution via validate_code() exec()
High Known exploited Also affects langflow
GHSA-rvqx-wpfh-mfx7
Langflow Unauth RCE
Critical Known exploited Also affects langflow
GHSA-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
Medium Also affects langflow
GHSA-4f6c-2vvp-gw82
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write
High Also affects langflow
GHSA-4hmc-cfm3-w43c
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
High Also affects langflow
GHSA-gh98-4phw-6fmw
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
Medium Also affects langflow

Credits: augustocesarperin

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor