CVE-2026-34926: Langflow CORS misconfiguration enables Account Takeover and RCE

CVE-2026-34926 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-12-06

Langflow, a platform for building AI agent workflows, contains a security flaw that allows attackers to take over user accounts and execute malicious code. By tricking a logged-in user into visiting a malicious website, an attacker can steal their session tokens. This could lead to a full system compromise, allowing unauthorized access to sensitive AI models and corporate data.

Technologies: Langflow, langflow (PyPI), Trend Micro Apex One (On-Premise). Vendors: Langflow, PyPI, Trend Micro.

Quick answers

Is CVE-2026-34926 exploited in the wild?
Yes. CVE-2026-34926 is known to be exploited in the wild, first recorded on 21 May 2026. Treat it as urgent.
How severe is CVE-2026-34926?
Critical severity, with a CVSS score of 8.8, published 6 December 2025.
Which products and versions are affected?
Langflow <= 1.6.9; langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.7.0.
Is there a fix for CVE-2026-34926?
Yes. langflow (PyPI): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34926 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34926?
Check whether you run Langflow, langflow (PyPI) or Trend Micro Apex One (On-Premise) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langflow (PyPI): upgrade to 1.7.0 or later
    pip install "langflow>=1.7.0"

Technical details

A chained vulnerability exists in Langflow (<= 1.6.9) involving an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token cookie set with SameSite=None. This combination allows a malicious cross-origin site to perform credentialed requests to the refresh endpoint, enabling an attacker to hijack access and refresh tokens. Once authenticated, an attacker can leverage Langflow's built-in code execution features to achieve remote code execution (RCE) and full system compromise. The issue is addressed in version 1.7.0.

Affected products

  • langflow-ai langflow <= 1.6.9

Identifiers

  • CVE-2026-34926
  • CVE-2025-34291
  • GHSA-577h-p2hh-v4mv
  • PYSEC-2025-78

Timeline

  • 2025-12-05: disclosed: NVD publication date
  • 2025-12-06: advisory: GitHub Advisory published
  • 2026-01-21: other: GitHub reviewed the advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.