PT-2025-49321 · Langflow · Langflow
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
Langflow versions prior to 1.7.0
Description
A chained issue enables account takeover and remote code execution. An overly permissive Cross-Origin Resource Sharing (CORS) configuration, where
allow origins is set to '*' and allow credentials is set to True, combined with a refresh token cookie configured as SameSite=None, allows a malicious webpage to perform cross-origin requests that include credentials. This allows an attacker-controlled origin to call the refresh endpoint and obtain fresh access token and refresh token pairs for a victim session. These tokens provide access to authenticated endpoints, including built-in code-execution functionality, allowing the attacker to execute arbitrary code and achieve full system compromise. This issue has been actively exploited in the wild.Recommendations
Update to a version later than 1.6.9 to resolve the issue.
Exploit
Fix
RCE
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Langflow