Actively exploited in the wild
Langflow Origin Validation Error Vulnerability
Langflow - Langflow · Listed in the CISA KEV since 2026-05-21. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-34291
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in Langflow versions up to and including 1.6.9 enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie set as SameSite=None allows a malicious webpage to perform cross-origin requests with credentials and call the refresh endpoint. An attacker can obtain fresh access_token/refresh_token pairs for a victim session and use them to execute arbitrary code, leading to full system compromise.
Risk Assessment
The risk for the organization includes complete user account takeover and remote code execution on the server, potentially leading to data theft, service disruption, and further escalation within the infrastructure.
Recommendation
Immediately upgrade Langflow to version 1.6.10 or later, which contains the fix. Additionally, restrict allowed origins in the CORS configuration and set SameSite to Lax or Strict for authentication cookies.
Other vulnerabilities in Langflow
See all- CVE-2026-105740Critical
Langflow before 1.9.0 allows any authenticated user to achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override).
- CVE-2026-105697Critical
Langflow before 1.10.3 launches whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command. The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server. With the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. With AUTO_LOGIN disabled, any authenticated (non-admin) user can exploit it.
- CVE-2026-51886Critical
Code Injection vulnerability in langflow up to 1.9.3. An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which executes code without sandboxing.
- CVE-2026-55450Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.1, unauthenticated users can upload unlimited amounts of data to the server, leading to space exhaustion. Additionally, the server response reveals the absolute path of the uploaded file, which constitutes an information leak.
- CVE-2026-55255HighActively exploited
In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
- CVE-2026-42048Critical
Langflow, a tool for building and deploying AI agents, is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases) prior to version 1.9.0. An attacker can exploit this flaw to delete arbitrary directories on the server.
- CVE-2026-33017CriticalActively exploited
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allowed building public flows without requiring authentication, leading to the possibility of remote code execution by unauthorized users.
- CVE-2026-0770CriticalActively exploited
A vulnerability in Langflow allows remote code execution via the exec_globals parameter in the validate endpoint. An unauthenticated attacker can inject malicious code from an untrusted source.
- CVE-2026-21445Critical
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.
- CVE-2025-68478High
Langflow prior to version 1.7.0 allows an arbitrary path to be specified in the request body's fs_path, causing the server to serialize the Flow object into JSON and create or overwrite a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is.
Original NVD description (English source)
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS