EUVD-2025-201507
GHSA-577h-p2hh-v4mv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfiguration (allow_origins='*' with credentials) and a SameSite=None refresh token cookie. An attacker controlling a malicious webpage can steal authentication tokens and gain full access, including built-in code execution, leading to complete system compromise. This vulnerability is confirmed actively exploited (CISA KEV), with publicly available exploit code and a high EPSS score (17.62%), indicating widespread attack likelihood.
Earlier versions of this analysis (1)
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints - including built-in code-execution functionality - allowing the attacker to execute arbitrary code and achieve full system compromise.
Executive ViewAI
Langflow versions 1.6.9 and earlier are vulnerable to account takeover and remote code execution through a combination of insecure cross-origin and authentication cookie configurations. Attackers can hijack user sessions and execute arbitrary code on affected systems without requiring a patch, creating immediate risk of data breach and infrastructure compromise for any organization running vulnerable Langflow instances.
Within 24 hours: Identify and inventory all Langflow deployments running version 1.6.9 or earlier; disable public internet access to Langflow instances if possible, or restrict to VPN/private networks only. Within 7 days: Implement WAF rules to block suspicious cross-origin requests to the refresh token endpoint; review and rotate all Langflow API tokens and user credentials; monitor authentication logs for suspicious token refresh activity. Within 30 days: Upgrade to Langflow 1.7.0 or later when patch is released; conduct security audit of Langflow configurations; implement network segmentation to limit lateral movement if compromise is detected.
Restrict network access to Langflow instances to trusted internal networks only; disable or restrict CORS to specific trusted origins only (remove allow_origins='*'); reconfigure refresh token cookies to SameSite=Strict; implement API rate limiting on authentication endpoints; deploy WAF rules to detect and block cross-origin token refresh requests; enable verbose logging and monitoring of token refresh activities; consider temporarily disabling Langflow if it cannot be isolated and patched is unavailable; rotate all authentication credentials and invalidate existing tokens.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Exploit-DB