CISA KEV (2026-05-21): CVE-2025-34291 Langflow CORS Token Hijack-to-RCE & CVE-2026-34926 Trend Micro Apex One On-Premise Directory Traversal

CISA KEV (2026-05-21) (TL-2026-0551), also tracked as Langflow CORS Token Hijack, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-05-21. It has no confirmed attribution, affects Langflow Langflow, references 2 CVEs (CVE-2025-34291, CVE-2026-34926), maps to 31 MITRE ATT&CK techniques (T1005, T1041, T1059), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0551

Threat ID
TL-2026-0551
Also known as
Langflow CORS Token Hijack, Langflow refresh-token chain, Apex One On-Premise Path Traversal (KA-0023430), JVNVU#90583059
Severity
CRITICAL
CVSS
9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-05-21
Last reviewed
2026-05-21
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, technology, ai-ml-development, managed-security-providers, healthcare, education, manufacturing
Target regions
North America, Europe, Asia Pacific, Japan, Latin America
Detection rules
9
Indicators of compromise
23

On 2026-05-21 CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-34291, a CORS/SameSite=None origin validation flaw in Langflow (<=1.6.9) that chains into unauthenticated account takeover and remote code execution via the platform's built-in code-execution endpoints; and CVE-2026-34926, a directory traversal in Trend Micro Apex One On-Premise that lets an attacker with admin access to the server tamper with a key configuration table to push attacker-controlled code down to managed endpoint agents. BOD 22-01 sets a Federal Civilian Executive Branch remediation deadline of 2026-06-04 for both issues.

How CISA KEV (2026-05-21) works

This advisory tracks the 2026-05-21 CISA KEV addition of two distinct, concurrently exploited vulnerabilities. The two flaws share no common code path but are reported together because they were promoted to KEV on the same day under Binding Operational Directive 22-01 with the same 2026-06-04 due date.

## CVE-2025-34291 — Langflow Origin Validation Error (CORS chain to ATO + RCE)

Langflow is an open-source visual builder for LLM-agent workflows widely deployed by AI engineering teams (frequently exposed to the public Internet, often in cloud-hosted developer instances). Versions up to and including 1.6.9 ship with two reinforcing misconfigurations:

1. The FastAPI CORS middleware is constructed with `allow_origins=['*']` combined with `allow_credentials=True`. The FastAPI/Starlette CORS implementation treats the wildcard as a permissive policy that echoes the requesting Origin header into `Access-Control-Allow-Origin` and emits `Access-Control-Allow-Credentials: true`, in violation of the Fetch spec's wildcard-with-credentials prohibition. As a result, any third-party site visited by an authenticated Langflow user can issue credentialed cross-origin requests against the victim's Langflow instance and receive readable responses. 2. The `refresh_token_lf` cookie used by the `/api/v1/refresh` endpoint is issued with `SameSite=None; Secure; HttpOnly`. Combined with the permissive CORS policy, a victim browser will attach the refresh-token cookie to a cross-origin `POST` from `evil.example` to `https://victim-langflow/api/v1/refresh`, and the response — including a freshly minted `access_token_lf` and a rotated `refresh_token_lf` — is readable by the attacker's JavaScript.

Once the attacker holds the access token they can call any authenticated Langflow endpoint, including the workflow-execution APIs (`/api/v1/run/*`, `/api/v1/build/*`) and the built-in code-execution node (`PythonFunction` / `PythonCodeStructured`), which evaluates arbitrary Python in the Langflow server process. This yields RCE as the Langflow service account on Linux containers — typically with outbound network egress and access to whatever credentials are mounted into the workflow runtime (OpenAI / Anthropic / vector-DB keys, embedded service tokens, mounted cloud credentials).

The exploit chain requires only that a logged-in operator or admin (a) has an active Langflow session and (b) visits or is redirected to an attacker-controlled web page — making this a `PR:N / UI:P` chain in CVSS v4 terms (NVD scored 9.4 CRITICAL v4, 8.8 HIGH v3.1). Spray-style exploitation is possible against Langflow instances exposed on shodan/censys with default authentication enabled, by phishing operators with crafted links that fire the cross-origin chain on click.

Langflow 1.9.3 is the fixed branch — `allow_origins` is narrowed and the refresh cookie is set to `SameSite=Lax`. Issue tracker entry langflow#11465 captures the upstream remediation event.

## CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal

Apex One is Trend Micro's enterprise endpoint protection product. The on-premise server hosts a management web console and a policy-distribution pipeline that pushes signed configuration and module updates to managed Apex One agents. A directory-traversal flaw (CWE-23) in a server-side administrative handler allows an authenticated administrator on the Apex One management host to write to file paths outside the intended configuration directory by supplying `..\` / `..\..\` traversal sequences inside a request that updates a server-side "key table" referenced during agent deployment.

Because the manipulated table is consumed during the agent update/deploy pipeline, an attacker who already owns Apex One admin credentials (e.g. via compromised IT staff workstation, harvested admin tokens, or post-exploitation lateral movement onto the Apex One server) can stage attacker-supplied code into the file paths from which the server builds agent payloads. The next deploy or update cycle then pushes that code to every Apex One agent — turning a compromised management plane into an enterprise-wide agent-side code execution event running with the high-privilege Apex One agent service account on every endpoint.

Trend Micro scored the issue 6.7 MEDIUM (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L) because successful exploitation presupposes administrative credentials, but CISA's KEV criteria weight the in-the-wild evidence and the downstream impact: the scope change to managed endpoints makes this a high-value step in real adversary intrusion chains where the endpoint-protection management plane is already compromised. Trend Micro Solution KA-0023430 (English) / KA-0022974 (Japanese) ships the fix; JPCERT/CC issued advisory JVNVU#90583059 and JPCERT at260014.

## Pipeline and Defender Action

For FCEB agencies and any organization tracking KEV, both CVEs must be remediated by 2026-06-04 per BOD 22-01. Langflow operators should upgrade to 1.9.3+, narrow CORS to known origins, set refresh cookies to `SameSite=Lax`, and block Internet exposure of dev Langflow instances at the edge. Apex One On-Premise administrators should apply KA-0023430, audit recent changes to server-side configuration/key tables, and treat any unexplained changes to the agent-deploy pipeline as potential supply-chain compromise inside the management plane.

MITRE ATT&CK techniques used in TL-2026-0551

Collection

T1005 Data from Local System

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Lateral Movement

T1072 Software Deployment Tools; T1080 Taint Shared Content

Initial Access

T1078 Valid Accounts; T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566 Phishing

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Persistence

T1098 Account Manipulation; T1505 Server Software Component

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1606 Forge Web Credentials

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Impact

T1565 Data Manipulation

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in CISA KEV (2026-05-21)

  • Langflow — Langflow
    Vulnerable versions: <= 1.6.9; 1.0.x; 1.1.x; 1.2.x; 1.3.x; 1.4.x; 1.5.x; 1.6.x
    Fixed in: >= 1.9.3
  • Trend Micro — Apex One (On-Premise)
    Vulnerable versions: Apex One 2019 On-Premise (pre-KA-0023430)
    Fixed in: Apex One On-Premise with KA-0023430 hotfix applied

Remediation for CISA KEV (2026-05-21)

Patches

  • Langflow >= 1.9.3 (CORS narrowed, refresh cookie SameSite hardened, refresh endpoint origin checks)
  • Trend Micro Apex One On-Premise patch per KA-0023430 (English) / KA-0022974 (Japanese)

Immediate actions

  • Langflow: Upgrade to Langflow 1.9.3 or later immediately; do not expose Langflow developer instances to the public Internet behind no authentication or with default credentials.
  • Langflow: Narrow `allow_origins` to a strict allow-list of trusted internal origins and set `allow_credentials=False` whenever a wildcard is unavoidable.
  • Langflow: Reissue all `refresh_token_lf` and `access_token_lf` sessions and rotate any API keys, model-provider tokens, or cloud credentials that were mounted into running workflows since 2025-09-01.
  • Apex One: Apply Trend Micro patch per Solution KA-0023430 to all on-premise Apex One management servers.
  • Apex One: Restrict administrative access to the Apex One server to a small jump-host pool with MFA; audit local administrator logins and recent changes to server configuration / key tables.
  • Both: Block egress from Langflow workers and Apex One servers to non-business destinations at the firewall while patching is in flight.

Workarounds

  • Langflow: front Langflow with a reverse proxy (nginx/Envoy/Cloudflare) that strips/validates Origin and rejects credentialed cross-origin requests until upgrade is possible.
  • Langflow: if upgrade is delayed, disable the Python code-execution components in workflows to remove the most damaging post-auth primitive.
  • Apex One: enforce IP allow-listing on the Apex One administrative web console and disable interactive logon to the management server for anyone outside the EDR-admin role.
  • Apex One: place file-integrity monitoring on agent-distribution directories (key tables, agent payload staging) until the patch is applied.

Longer-term hardening

  • Treat AI-tooling servers (Langflow, LiteLLM, Flowise, Dify, LangServe) as Tier-1 application infrastructure requiring auth, network segmentation, secret-store integration, and routine vulnerability scanning rather than as ephemeral developer toys.
  • Adopt `SameSite=Lax` (or `Strict` where workflow allows) as a default for authentication cookies across all internal web applications; ban `SameSite=None` for any cookie that grants session-mint capability without explicit threat-model review.
  • Treat the endpoint-protection management plane (Apex One, SCCM, Intune, EDR consoles) as a Tier-0 asset on par with domain controllers — equivalent monitoring, change control, and PAM-gated administration.
  • Build detections for cross-origin requests to refresh / token endpoints from non-allow-listed Origin headers, and for unexpected writes to agent-distribution configuration files on endpoint-protection servers.

CVEs associated with CISA KEV (2026-05-21)

CVE-2025-34291, CVE-2026-34926

Weaknesses (CWE) in CISA KEV (2026-05-21)

CWE-346, CWE-23

Timeline of CISA KEV (2026-05-21)

  • VulnCheck and Obsidian Security researchers begin coordinated review of Langflow authentication surface following earlier 2025 Langflow CVE clusters; CORS + SameSite=None chain identified as a token-mint primitive.
  • Coordinated disclosure of the Langflow CORS / refresh-cookie chain to Langflow maintainers; CVE-2025-34291 reserved via VulnCheck CNA.
  • Langflow upstream issue #11465 opened tracking the CORS narrowing and refresh-cookie SameSite=Lax change.
  • Langflow 1.9.3 published with narrowed CORS allow-list and SameSite=Lax refresh cookie; advisory drafts circulated to partners.
  • VulnCheck publishes public advisory 'Langflow CORS Misconfiguration to Token Hijack and RCE' with exploit chain detail.
  • Obsidian Security publishes long-form blog on CVE-2025-34291 covering the browser-trust amplifier and AI-engineering stack implications.
  • Trend Micro publishes KA-0023430 (English) / KA-0022974 (Japanese) for the Apex One On-Premise directory traversal; JPCERT/CC issues JVNVU#90583059 and at260014.
  • Threadlinqs Intelligence publishes TL-2026-0551 covering both KEV additions with combined remediation guidance, detections, and simulation runbooks.
  • CISA adds CVE-2025-34291 and CVE-2026-34926 to the Known Exploited Vulnerabilities Catalog citing evidence of active exploitation. Federal due date set to 2026-06-04 under BOD 22-01.
  • As of 2026-05-29, both CVEs remain actively exploited: Langflow CVE-2025-34291 has been hit in the wild since Jan 2026 (Iranian APT MuddyWater for initial access) and Trend Micro Apex One CVE-2026-34926 is a confirmed zero-day. Both sit in CISA KEV; patches (Langflow 1.9.3, Apex One KA-0023430) exist but the BOD 22-01 deadline (2026-06-04) is still pending.
  • BOD 22-01 remediation deadline for Federal Civilian Executive Branch agencies for both CVE-2025-34291 and CVE-2026-34926.

Sources cited for CISA KEV (2026-05-21)

Threats related to CISA KEV (2026-05-21)

Detection coverage for TL-2026-0551

As of 2026-05-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0551 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats