CVE-2025-34291 Elastic Security · Elastic

Detect CVE-2025-34291: Langflow Origin Validation Error Exploitation in Elastic Security

Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by source.ip with maxspan=2m
  [network where event.dataset in ("nginx.access", "apache.access", "iis.access") and
   (
     url.path like~ "/api/v1/*" or
     url.path like~ "/api/v2/*" or
     url.path like~ "/flows*" or
     url.path like~ "/run*" or
     url.path like~ "/build*"
   ) and
   http.request.method in ("POST", "PUT", "DELETE", "PATCH") and
   http.response.status_code in (200, 201, 202, 204) and
   (
     not exists(http.request.referrer) or
     http.request.referrer == "null" or
     http.request.referrer == ""
   )
  ] with runs=3
high severity medium confidence

EQL sequence detecting repeated mutating API requests to Langflow endpoints from the same source IP where the Referer/Origin header is absent or null, consistent with CVE-2025-34291 origin validation bypass.

Data Sources

Nginx Access LogsApache Access LogsIIS Access LogsElastic APM

Required Tables

logs-nginx.access-*logs-apache.access-*logs-iis.access-*

False Positives & Tuning

  • API clients and SDKs that programmatically call Langflow without browser-generated headers
  • Continuous integration pipelines that invoke Langflow flows as part of automated testing
  • Internal microservices communicating with Langflow API without Referer headers
  • Browser privacy settings or extensions that strip Referer headers on cross-origin navigations

Other platforms for CVE-2025-34291

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2025-34291 - Missing Origin Header Flow Execution

    Expected signal: Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine

  2. Test 2CVE-2025-34291 - Null Origin Header Bypass Attempt

    Expected signal: Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201

  3. Test 3CVE-2025-34291 - Cross-Origin Mismatch API Access

    Expected signal: Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204

  4. Test 4CVE-2025-34291 - Automated Flow Enumeration Without Origin

    Expected signal: Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state

Last updated: 2026-06-19 Research depth: standard
References (4)

Unlock Pro Content

Get the full detection package for CVE-2025-34291 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1552Unsecured Credentials

Same Tactic: Initial Access

Popular Detections