Langflow malicious-webpage takeover flaw CVE-2025-34291 used in attacks; fix available
Attackers have exploited Langflow CVE-2025-34291 to take over accounts and run server code when users visit malicious pages. Versions through 1.6.9 are affected. Upgrade to a current stable release and apply Langflow’s CORS and cookie guidance.
If your business uses Langflow, ask its administrator to install a current stable release; Langflow recommended 1.9.3 in May, and 1.7.0 was withdrawn from PyPI. Have them restrict LANGFLOW_CORS_ORIGINS to trusted sites or set LANGFLOW_CORS_ALLOW_CREDENTIALS=false, and set LANGFLOW_REFRESH_SAME_SITE=lax or strict. If compromise is suspected, have them investigate and replace credentials stored in Langflow.
What’s happening
Langflow, a tool for building AI agents and workflows, had a browser-security flaw that let a malicious webpage take over a signed-in user’s account and run code on the Langflow server. Stored API keys and other service credentials could also be exposed, and an internal server could be reached through its user’s browser. Obsidian disclosed the issue in December 2025; CrowdSec reported exploitation from 23 January 2026, and CISA listed it on 21 May. Langflow confirms that versions through 1.6.9 are affected and 1.7.0 contained the fix. That release was subsequently withdrawn from PyPI for an unrelated regression; administrators should use a current stable release. Langflow’s June follow-up still recommends explicit CORS and cookie settings, because the refresh cookie retains its permissive default. The campaign’s full scale and whether attacks have stopped remain unknown.
- What
- Flaw
- Affects
- Langflow AI agent and workflow platform
- Affected
- Langflow versions up to and including 1.6.9
- Fixed in
- Langflow 1.7.0 (first fixed release; subsequently withdrawn from PyPI for an unrelated regression)
Langflow 1.9.3 (recommended by the vendor in May 2026) - Since
- 21 May 2026
- Closed
- 23 June 2026
Timeline
- Vendor revisedFixed
Langflow closed the issue, confirming that versions through 1.6.9 are affected and 1.7.0 shipped the fix. It said the refresh cookie still defaults to SameSite=None and recommended explicitly selecting lax or strict.
- Vendor revisedFixed
Langflow recommended upgrading to 1.9.3 and explicitly restricting cross-origin access and strengthening refresh-cookie settings.
- CISA added
CISA added the flaw to its Known Exploited Vulnerabilities catalogue, with a 4 June remediation deadline for US federal civilian agencies. Ransomware use is recorded as unknown.
- Wider attacks
CrowdSec began observing exploitation, according to its 26 January report. It could not establish the full scale of the campaign.
- New fix
Langflow released 1.7.0, which its maintainers later confirmed contained the fix. The release page now warns that this version was withdrawn from PyPI because of an unrelated data-display regression.
- Made publicPartly fixed
Obsidian publicly disclosed CVE-2025-34291. Langflow through 1.6.9 remained vulnerable under default settings, although administrators could change the configuration.
- UpdateNo fix yet
Obsidian Security privately reported the vulnerability to Langflow and DataStax. It says an initial cookie-security change did not mitigate the problem.
Sources
- Inquiry Regarding CVE-2025-34291 Patch — maintainer guidance and resolutionLangflow · 23 June 2026
- Langflow 1.7.0 releaseLangflow · 18 Dec 2025
- Langflow 1.9.3 security releaseLangflow · 15 May 2026
- CVE-2025-34291: Critical Account Takeover and RCE Vulnerability in the Langflow AI Agent & Workflow PlatformObsidian Security · 7 Sept 2026
- CVE-2025-34291 Exploited in the Wild: LangFlow AI Framework Under FireCrowdSec · 26 Jan 2026
- Langflow CORS misconfiguration enables Account Takeover and RCEGitHub · 29 May 2026
- Known Exploited Vulnerabilities catalogue — CVE-2025-34291CISA · 3 Nov 2026