Summary
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.
- Vendor
- Langflow
- Product
- Langflow
- Added to KEV
- May 21, 2026
- Remediation due
- Jun 4, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-346
- EPSS
- 93.2% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References