# CISA KEV (2026-05-21): CVE-2025-34291 Langflow CORS Token Hijack-to-RCE & CVE-2026-34926 Trend Micro Apex One On-Premise Directory Traversal

> On 2026-05-21 CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-34291, a CORS/SameSite=None origin validation flaw in Langflow (<=1.6.9) that chains into unauthenticated account takeover and remote code execution via the platform's built-in code-execution endpoints; and CVE-2026-34926, a directory traversal in Trend Micro Apex One On-Premise that lets an attacker with admin access to the server tamper with a key configuration table to push attacker-controlled code down to managed endpoint agents. BOD 22-01 sets a Federal Civilian Executive Branch remediation deadline of 2026-06-04 for both issues.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0551
- **ID:** TL-2026-0551
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-34291, CVE-2026-34926

## Description

This advisory tracks the 2026-05-21 CISA KEV addition of two distinct, concurrently exploited vulnerabilities. The two flaws share no common code path but are reported together because they were promoted to KEV on the same day under Binding Operational Directive 22-01 with the same 2026-06-04 due date.

## CVE-2025-34291 — Langflow Origin Validation Error (CORS chain to ATO + RCE)

Langflow is an open-source visual builder for LLM-agent workflows widely deployed by AI engineering teams (frequently exposed to the public Internet, often in cloud-hosted developer instances). Versions up to and including 1.6.9 ship with two reinforcing misconfigurations:

1. The FastAPI CORS middleware is constructed with `allow_origins=['*']` combined with `allow_credentials=True`. The FastAPI/Starlette CORS implementation treats the wildcard as a permissive policy that echoes the requesting Origin header into `Access-Control-Allow-Origin` and emits `Access-Control-Allow-Credentials: true`, in violation of the Fetch spec's wildcard-with-credentials prohibition. As a result, any third-party site visited by an authenticated Langflow user can issue credentialed cross-origin requests against the victim's Langflow instance and receive readable responses.
2. The `refresh_token_lf` cookie used by the `/api/v1/refresh` endpoint is issued with `SameSite=None; Secure; HttpOnly`. Combined with the permissive CORS policy, a victim browser will attach the refresh-token cookie to a cross-origin `POST` from `evil.example` to `https://victim-langflow/api/v1/refresh`, and the response — including a freshly minted `access_token_lf` and a rotated `refresh_token_lf` — is readable by the attacker's JavaScript.

Once the attacker holds the access token they can call any authenticated Langflow endpoint, including the workflow-execution APIs (`/api/v1/run/*`, `/api/v1/build/*`) and the built-in code-execution node (`PythonFunction` / `PythonCodeStructured`), which evaluates arbitrary Python in the Langflow server process. This yields RCE as the Langflow service account on Linux containers — typically with outbound network egress and access to whatever credentials are mounted into the workflow runtime (OpenAI / Anthropic / vector-DB keys, embedded service tokens, mounted cloud credentials).

The exploit chain requires only that a logged-in operator or admin (a) has an active Langflow session and (b) visits or is redirected to an attacker-controlled web page — making this a `PR:N / UI:P` chain in CVSS v4 terms (NVD scored 9.4 CRITICAL v4, 8.8 HIGH v3.1). Spray-style exploitation is possible against Langflow instances exposed on shodan/censys with default authentication enabled, by phishing operators with crafted links that fire the cross-origin chain on click.

Langflow 1.9.3 is the fixed branch — `allow_origins` is narrowed and the refresh cookie is set to `SameSite=Lax`. Issue tracker entry langflow#11465 captures the upstream remediation event.

## CVE-2026-34926 — Trend Micro Apex One (On-Premise) Directory Traversal

Apex One is Trend Micro's enterprise endpoint protection product. The on-premise server hosts a management web console and a policy-distribution pipeline that pushes signed configuration and module updates to managed Apex One agents. A directory-traversal flaw (CWE-23) in a server-side administrative handler allows an authenticated administrator on the Apex One management host to write to file paths outside the intended configuration directory by supplying `..\` / `..\..\` traversal sequences inside a request that updates a server-side "key table" referenced during agent deployment.

Because the manipulated table is consumed during the agent update/deploy pipeline, an attacker who already owns Apex One admin credentials (e.g. via compromised IT staff workstation, harvested admin tokens, or post-exploitation lateral movement onto the Apex One server) can stage attacker-supplied code into the file paths from which the server builds agent payloads. The next deploy or update cycle then pushes that code to every Apex One agent — turning a compromised management plane into an enterprise-wide agent-side code execution event running with the high-privilege Apex One agent service account on every endpoint.

Trend Micro scored the issue 6.7 MEDIUM (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L) because successful exploitation presupposes administrative credentials, but CISA's KEV criteria weight the in-the-wild evidence and the downstream impact: the scope change to managed endpoints makes this a high-value step in real adversary intrusion chains where the endpoint-protection management plane is already compromised. Trend Micro Solution KA-0023430 (English) / KA-0022974 (Japanese) ships the fix; JPCERT/CC issued advisory JVNVU#90583059 and JPCERT at260014.

## Pipeline and Defender Action

For FCEB agencies and any organization tracking KEV, both CVEs must be remediated by 2026-06-04 per BOD 22-01. Langflow operators should upgrade to 1.9.3+, narrow CORS to known origins, set refresh cookies to `SameSite=Lax`, and block Internet exposure of dev Langflow instances at the edge. Apex One On-Premise administrators should apply KA-0023430, audit recent changes to server-side configuration/key tables, and treat any unexplained changes to the agent-deploy pipeline as potential supply-chain compromise inside the management plane.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1190 Exploit Public-Facing Application
- T1189 Drive-by Compromise
- T1566 Phishing
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1539 Steal Web Session Cookie
- T1606 Forge Web Credentials
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1072 Software Deployment Tools
- T1080 Taint Shared Content
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation

## Sources

- [CISA Alert: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-05-21)](https://www.cisa.gov/news-events/alerts/2026/05/21/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Binding Operational Directive 22-01](https://www.cisa.gov/news-events/directives/binding-operational-directive-22-01)
- [NVD — CVE-2025-34291](https://nvd.nist.gov/vuln/detail/CVE-2025-34291)
- [NVD — CVE-2026-34926](https://nvd.nist.gov/vuln/detail/CVE-2026-34926)
- [VulnCheck — Langflow CORS Misconfiguration to Token Hijack and RCE](https://www.vulncheck.com/advisories/langflow-cors-misconfiguration-to-token-hijack-and-rce)
- [Obsidian Security — CVE-2025-34291 Critical Account Takeover & RCE in Langflow](https://www.obsidiansecurity.com/blog/cve-2025-34291-critical-account-takeover-and-rce-vulnerability-in-the-langflow-ai-agent-workflow-platform)
- [Langflow GitHub repository](https://github.com/langflow-ai/langflow)
- [Langflow 1.9.3 release notes](https://github.com/langflow-ai/langflow/releases/tag/v1.9.3)
- [Langflow issue #11465 (CORS / refresh-token fix tracking)](https://github.com/langflow-ai/langflow/issues/11465)
- [Trend Micro Solution KA-0023430 (English)](https://success.trendmicro.com/en-US/solution/KA-0023430)
- [Trend Micro Solution KA-0022974 (Japanese)](https://success.trendmicro.com/ja-JP/solution/KA-0022974)
- [JPCERT/CC JVNVU#90583059](https://jvn.jp/en/vu/JVNVU90583059/)
- [JPCERT/CC at260014 — Trend Micro Apex One vulnerability alert](https://www.jpcert.or.jp/english/at/2026/at260014.html)
- [Malwarebytes — Microsoft Defender vulnerabilities exploited in the wild (related KEV-day coverage)](https://www.malwarebytes.com/blog/bugs/2026/05/microsoft-defender-vulnerabilities-are-being-exploited-in-the-wild)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0551