CVE-2025-34291—Langflow Origin Validation Error Vulnerability

漏洞名称

Langflow Origin Validation Error Vulnerability

描述

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow
• https://github.com/langflow-ai/langflow/releases/tag/v1.9.3
• https://github.com/langflow-ai/langflow/issues/11465#event-25774545848
• https://nvd.nist.gov/vuln/detail/CVE-2025-34291

相关新闻文章

• Langflow Vulnerability CVE-2026-5027 Exploited for Unauthenticated RCEJune 10, 2026
• Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCEJune 10, 2026
• CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEVMay 22, 2026

相关 CWE

• CWE-346