Known Exploited Vulnerabilities May 21, 2026 · CISA KEV Catalog

CVE-2025-34291: Langflow Origin Validation Error Vulnerability

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-34291 Langflow
Related: CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026
CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability Known Exploited Vulnerabilities · Jul 07, 2026
CVE-2026-33017: Langflow Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2026