Executive brief
Langflow, a platform for building AI agent workflows, contains a security flaw that allows attackers to take over user accounts and execute malicious code. By tricking a logged-in user into visiting a malicious website, an attacker can steal their session tokens. This could lead to a full system compromise, allowing unauthorized access to sensitive AI models and corporate data.
Technical details
A chained vulnerability exists in Langflow (<= 1.6.9) involving an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token cookie set with SameSite=None. This combination allows a malicious cross-origin site to perform credentialed requests to the refresh endpoint, enabling an attacker to hijack access and refresh tokens. Once authenticated, an attacker can leverage Langflow's built-in code execution features to achieve remote code execution (RCE) and full system compromise. The issue is addressed in version 1.7.0.
Affected products
- langflow-ai langflow <= 1.6.9
CVE identifiers
- CVE-2026-34926
- CVE-2025-34291
Timeline
- 2025-12-05: disclosed: NVD publication date
- 2025-12-06: advisory: GitHub Advisory published
- 2026-01-21: other: GitHub reviewed the advisory
References
- https://api.github.com/users/augustocesarperin
- https://github.com/augustocesarperin
- https://api.github.com/users/augustocesarperin/gists%7B/gist_id%7D
- https://api.github.com/users/augustocesarperin/repos
- https://avatars.githubusercontent.com/u/39884783?v=4
- https://api.github.com/users/augustocesarperin/events%7B/privacy%7D