# CVE-2026-34926: Langflow CORS misconfiguration enables Account Takeover and RCE

Source: https://junglewise.ai/threats/cve-2025-34291-langflow-cors-misconfiguration-and-account-takeover-leading-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-06. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-34926 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-12-06

Langflow, a platform for building AI agent workflows, contains a security flaw that allows attackers to take over user accounts and execute malicious code. By tricking a logged-in user into visiting a malicious website, an attacker can steal their session tokens. This could lead to a full system compromise, allowing unauthorized access to sensitive AI models and corporate data.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow), [langflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-langflow), [Trend Micro Apex One (On-Premise)](https://junglewise.ai/threats/technologies/apex-one). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow), [PyPI](https://junglewise.ai/threats/vendors/pypi), [Trend Micro](https://junglewise.ai/threats/vendors/trend-micro).

## Quick answers

**Is CVE-2026-34926 exploited in the wild?** Yes. CVE-2026-34926 is known to be exploited in the wild, first recorded on 21 May 2026. Treat it as urgent.

**How severe is CVE-2026-34926?** Critical severity, with a CVSS score of 8.8, published 6 December 2025.

**Which products and versions are affected?** Langflow <= 1.6.9; langflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.7.0.

**Is there a fix for CVE-2026-34926?** Yes. langflow (PyPI): upgrade to 1.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34926 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34926?** Check whether you run Langflow, langflow (PyPI) or Trend Micro Apex One (On-Premise) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langflow (PyPI): upgrade to 1.7.0 or later

  ```sh
  pip install "langflow>=1.7.0"
  ```


## Technical details

A chained vulnerability exists in Langflow (<= 1.6.9) involving an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token cookie set with SameSite=None. This combination allows a malicious cross-origin site to perform credentialed requests to the refresh endpoint, enabling an attacker to hijack access and refresh tokens. Once authenticated, an attacker can leverage Langflow's built-in code execution features to achieve remote code execution (RCE) and full system compromise. The issue is addressed in version 1.7.0.

## Affected products

- langflow-ai langflow <= 1.6.9

## Identifiers

- CVE-2026-34926
- CVE-2025-34291
- GHSA-577h-p2hh-v4mv
- PYSEC-2025-78

## Timeline

- 2025-12-05: disclosed: NVD publication date
- 2025-12-06: advisory: GitHub Advisory published
- 2026-01-21: other: GitHub reviewed the advisory

## References

- [https://api.github.com/users/augustocesarperin](https://api.github.com/users/augustocesarperin)
- [https://github.com/augustocesarperin](https://github.com/augustocesarperin)
- [https://api.github.com/users/augustocesarperin/gists%7B/gist_id%7D](https://api.github.com/users/augustocesarperin/gists%7B/gist_id%7D)
- [https://api.github.com/users/augustocesarperin/repos](https://api.github.com/users/augustocesarperin/repos)
- [https://avatars.githubusercontent.com/u/39884783?v=4](https://avatars.githubusercontent.com/u/39884783?v=4)
- [https://api.github.com/users/augustocesarperin/events%7B/privacy%7D](https://api.github.com/users/augustocesarperin/events%7B/privacy%7D)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow IP spoofing in MCP configuration installation](https://junglewise.ai/threats/cve-2026-105741-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow path traversal and cross-user disclosure in MCP resources](https://junglewise.ai/threats/cve-2026-105699-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)