CVE Watch8 oct 2026

CVE-2025-34291

Langflow Origin Validation Error Vulnerability

CVSS

8.8

Alto

EPSS

92.8%

p100

KEV

SÍ

21 may 2026

Exploit Today

0-100

Publicado: 5 dic 2025 · Última mod.: 8 oct 2026 · CWE-346

EPSS · 30d

83.6%EPSS · 30 días92.8%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

Langflow / Langflow

Vulnerabilidad

Langflow Origin Validation Error Vulnerability

Añadido a KEV

21 may 2026

Remediar antes de

4 jun 2026

Uso conocido en ransomware

Descripción resumida

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow ; https://github.com/langflow-ai/langflow/releases/tag/v1.9.3; https://github.com/langflow-ai/langflow/issues/11465#event-25774545848 ; https://nvd.nist.gov/vuln/detail/CVE-2025-34291

Descripción técnica

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-101897—

—

——0Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.15h CVE-2026-973819.9 CRÍ

10.8%

——3Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.1d CVE-2026-962386.5 MED

13.4%

——4Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.1d CVE-2026-962345.3 MED

19.3%

——6Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.1d CVE-2026-881325.9 MED

23.2%

——7Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.1d CVE-2026-702138.0 ALT

23.0%

——7Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.1d