CVE-2025-34291: Langflow Origin Validation Error – Over‑Permissive CORS & SameSite=None Cookie Leads to Credential‑Theft and Full System Compromise
What It Is – Langflow’s web UI ships with an overly permissive Cross‑Origin Resource Sharing (CORS) policy. Coupled with a refresh‑token cookie set to SameSite=None, a malicious site can issue cross‑origin requests that include credentials and call the token‑refresh endpoint.
Exploitability – The flaw is publicly disclosed (CVE‑2025‑34291) and can be weaponised without prior access; a proof‑of‑concept exists. CVSS v3.1 is rated 8.6 (High).
Affected Products – Langflow (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Control Mapping – The issue maps to the “Secure Configuration Management” control area, a single objective that satisfies requirements across NIST CSF, ISO 27001, and SOC 2.
- Continuous Evidence – Demonstrating that CORS policies and cookie attributes are locked down provides audit‑ready evidence of a defended perimeter.
- Defensible Audit Trail – Remediating and documenting the configuration change creates a traceable control‑execution record that buyers increasingly demand.
Recommended Actions
- Immediately review and tighten Langflow’s CORS whitelist to allow only trusted origins.
- Change the refresh‑token cookie
SameSiteattribute toLaxorStrictand enforceSecureflag. - Run automated configuration scans (e.g., CSP, CORS, cookie hygiene) and capture the results as compliance evidence.
- Deploy a patch or upgrade to the vendor‑released version that resolves CVE‑2025‑34291.
- Update your control‑mapping inventory to reflect the corrected configuration and retain the evidence for future audits.
Source: CISA KEV – CVE‑2025‑34291