Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover
    and remote code execution. An overly permissive CORS configuration (allow_origins='*' with
    allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a
    malicious webpage to perform cross-origin requests that include credentials and successfully call the
    refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token
    pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in
    code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system
    compromise. (CVE-2025-34291)

The version of Langflow installed on the remote host is prior to 1.7.0. It is, therefore, affected by a remote code execution vulnerability:

  - An overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None     allows a malicious webpage to perform cross-origin requests that include credentials and successfully call     the refresh endpoint. An attacker can obtain fresh access tokens for a victim session and use them to     access authenticated endpoints, including built-in code-execution functionality, achieving full system     compromise. (CVE-2025-34291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of Langflow running on the remote host is prior to 1.7.0. It is, therefore, affected by an account takeover vulnerability. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with refresh tokens issued with SameSite=None allows a malicious webpage visited by an authenticated user to issue cross-origin requests, steal authentication tokens, and abuse the built-in code execution endpoint to achieve remote code execution and complete system compromise.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
442495	SCA: security update for langflow (GHSA-577h-p2hh-v4mv)	Tenable Cloud Security	SCA Checks	Local	critical
442495	SCA: security update for langflow (GHSA-577h-p2hh-v4mv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
317391	Langflow < 1.7.0 CORS Misconfiguration Account Takeover and RCE (CVE-2025-34291)	Nessus	Artificial Intelligence	Combined	critical
115252	Langflow < 1.7.0 Account Takeover	Web App Scanning	Artificial Intelligence	Version Based	critical

Detections

Analytics

CVE-2025-34291

critical

Tenable Plugins

critical

critical

critical

critical