CVE-2025-34291

CVE-2025-34291 is a critical origin-validation vulnerability in the Langflow open-source LLM pipeline builder, rated CVSS 9.4. The flaw combines three compounding weaknesses: permissive CORS headers that allow cross-origin requests from arbitrary domains, the absence of CSRF token enforcement, and the presence of a code-execution API endpoint that is intentional by product design but becomes catastrophically exploitable when the access controls collapse. An unauthenticated remote attacker can exploit the combination to execute arbitrary code on the Langflow server and access any downstream service tokens stored in active pipelines.

CISA added CVE-2025-34291 to the Known Exploited Vulnerabilities catalogue on 21 May 2026. A March 2026 threat analysis documented the Iran-nexus group MuddyWater (MOIS-linked) using the flaw for initial access into targeted organisations. The combination of a CVSS 9.4 severity rating and attribution to a state-backed actor makes this among the higher-priority KEV additions of Q2 2026.

The CVSS 9.4 score reflects both unauthenticated remote exploitability and the breadth of potential impact: a Langflow server stores API tokens for every downstream LLM, database, and API it orchestrates. Compromise of a Langflow instance is therefore not bounded by the Langflow server itself but extends to every connected service. This token-harvesting dimension elevates the real-world blast radius significantly beyond what a single application compromise normally implies.