CVE-2025-34291 — Langflow Langflow: Langflow Origin Validation Error Vulnerability
CVE-2025-34291 — Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the
What This Means For You
- CISA has confirmed active exploitation — immediate patching required.
- Added to CISA KEV catalog — federal agencies must remediate by 2026-06-04.
Related ATT&CK Techniques
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2025-34291 | RCE | Langflow affected by overly permissive CORS configuration |
| CVE-2025-34291 | Auth Bypass | Langflow refresh token cookie configured as SameSite=None |
| CVE-2025-34291 | Code Injection | Langflow vulnerable to cross-origin requests including credentials to refresh endpoint |
| CVE-2025-34291 | Misconfiguration | Langflow origin validation error vulnerability |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | CISA |
| Channel | CISA KEV |
| Channel ID | cisa-kev |
| Message ID | 202534291 |
| Published | May 21, 2026 at 15:00 UTC |
| Original Link | https://github.com/langflow-ai/langflow |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-4843 — The GSheet For Woo Importer plugin for WordPress is
CVE-2026-4843 — The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the...
IINA CVE-2026-47114: macOS Command Execution via Malicious URL
CVE-2026-47114 — IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters...
Daily Security Digest — 2026-05-21
48 vulnerability disclosures (6 Critical, 42 High) and 20 curated intelligence stories from 7 sources.