Langflow CORS Misconfiguration and Token Hijacking leading to Remote Code Execution (CVE-2025-34291)

1. Official Patch Application

Upgrade your Langflow package to the latest secure version.

pip install --upgrade langflow

2. Temporary Mitigations (If patching cannot be applied immediately)

A. Restrict CORS Configurations

Modify the Langflow configuration or reverse proxy (e.g., Nginx, Apache) to ensure that the Access-Control-Allow-Origin header is not set to a wildcard (*) when credentials are allowed. Restrict allowed origins to trusted internal domains only.

B. Harden Cookie Attributes

Force the SameSite attribute of the refresh token cookie to Lax or Strict and ensure the Secure flag is enabled via your application configuration or reverse proxy layer.

C. WAF (Web Application Firewall) Rules

Deploy WAF rules to detect and block suspicious cross-origin requests targeting Langflow API endpoints, particularly the /api/v1/refresh and workflow execution endpoints.

CVE-2025-34291 is a chained vulnerability in the Langflow platform arising from a combination of permissive CORS (Cross-Origin Resource Sharing) and insecure cookie configurations.

• CORS and Cookie Misconfiguration (CWE-346): Langflow was configured with an overly permissive CORS policy (allow_origins='*' combined with allow_credentials=True). Concurrently, the refresh token cookie was configured with SameSite=None.
• Token Hijacking Mechanics: When an authenticated victim visits a malicious webpage controlled by an attacker, the page can initiate cross-origin requests to Langflow's refresh endpoint. Because of the SameSite=None attribute, the browser automatically includes the victim's credentials (refresh token cookie) in the request. The permissive CORS policy allows the malicious origin to read the response and successfully hijack the newly generated access_token and refresh_token pairs.
• Remote Code Execution (RCE): Using the hijacked tokens, the attacker gains unauthorized access to authenticated endpoints. By leveraging Langflow's built-in code execution capabilities (such as Python code blocks within workflows), the attacker can execute arbitrary system commands, resulting in complete compromise of the host system.

This vulnerability has been actively exploited in the wild and is listed in the CISA KEV catalog with an EPSS score of 0.94, requiring immediate remediation.