2025-10 · 2025-Q4

Langflow Account Takeover and RCE Chain

Primary layerL6 Identity / RunSecondary:L5 Config L1 Credential

Which agent, run, or tenant is this?
The question layer 6 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

Langflow (versions up to 1.6.9)

Impact

Complete instance compromise; all stored API keys exposed

Root cause

Overly permissive CORS + missing CSRF protection + code validation endpoint

CVE

CVE-2025-34291

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Langflow Account Takeover and RCE Chain (2025-10). https://agentprov.com/incidents/2025-10-langflow-account-takeover-and-rce-chain

Same event · 2026-01-23Langflow Active Exploitation Deploys Flodrix BotnetL6Identity / Run
Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run