CVE-2025-34291 Microsoft Sentinel · KQL

Detect CVE-2025-34291: Langflow Origin Validation Error Exploitation in Microsoft Sentinel

Detects exploitation of CVE-2025-34291, an origin validation error (CWE-346) in Langflow that allows attackers to bypass origin checks. This vulnerability is actively exploited in the wild (CISA KEV) and may enable unauthorized access to Langflow API endpoints, flow execution, or administrative functions by bypassing cross-origin restrictions.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Lateral Movement

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union DeviceNetworkEvents, W3CIISLog, AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where (
    (csHost has_any ("langflow", "langflow-api") or csUriStem has_any ("/api/v1/", "/api/v2/", "/flows", "/run", "/build"))
    or (ResourceType == "APPLICATIONGATEWAYS" and requestUri_s has_any ("/api/v1/", "/flows", "/run"))
  )
| where csRefererHeader !has csHost or csRefererHeader has_any ("null", "about:blank") or isempty(csRefererHeader)
| where csMethod in ("POST", "PUT", "DELETE", "PATCH")
| where scStatus in (200, 201, 202, 204)
| extend SuspiciousOrigin = case(
    isempty(csRefererHeader), "Missing Referer",
    csRefererHeader has "null", "Null Origin",
    csRefererHeader !has csHost, "Cross-Origin Mismatch",
    "Legitimate"
  )
| where SuspiciousOrigin != "Legitimate"
| project TimeGenerated, csClientIP, csMethod, csUriStem, csRefererHeader, scStatus, SuspiciousOrigin, csUserAgent
| summarize RequestCount=count(), Methods=make_set(csMethod), Endpoints=make_set(csUriStem) by csClientIP, SuspiciousOrigin, bin(TimeGenerated, 5m)
| where RequestCount > 2
high severity medium confidence

Detects suspicious cross-origin requests to Langflow API endpoints where the Origin or Referer header is absent, null, or mismatched, which may indicate exploitation of CVE-2025-34291 origin validation bypass.

Data Sources

IIS LogsAzure Application Gateway LogsAzure DiagnosticsNetwork Events

Required Tables

W3CIISLogAzureDiagnosticsDeviceNetworkEvents

False Positives & Tuning

  • Internal automation or API clients that do not send Origin/Referer headers
  • Health check endpoints called by load balancers without referrer headers
  • Browser extensions or API testing tools (Postman, curl) used by legitimate developers
  • Server-side rendering frameworks that make backend-to-backend API calls

Other platforms for CVE-2025-34291

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2025-34291 - Missing Origin Header Flow Execution

    Expected signal: Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine

  2. Test 2CVE-2025-34291 - Null Origin Header Bypass Attempt

    Expected signal: Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201

  3. Test 3CVE-2025-34291 - Cross-Origin Mismatch API Access

    Expected signal: Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204

  4. Test 4CVE-2025-34291 - Automated Flow Enumeration Without Origin

    Expected signal: Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state

Last updated: 2026-06-19 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) making requests with missing/null/mismatched Origin or Referer headers to Langflow API endpoints. Cross-reference with known IP reputation feeds and internal asset inventory to determine if the source is internal automation or an external threat actor.
  2. Determine which Langflow API endpoints were targeted. Endpoints such as /api/v1/run, /api/v1/build, and /flows indicate potential flow execution or exfiltration. Check if the requests succeeded (2xx responses) and what data or actions were triggered.
  3. Review Langflow application logs for the corresponding time window to identify authenticated vs. unauthenticated access, specific flows executed, any file reads/writes, or connections to external services initiated as a result of the flows being triggered.
  4. Verify the Langflow version deployed. If running < 1.9.3, the system is unpatched and vulnerable. Immediate escalation and containment are warranted even if exploitation intent is unclear.

Containment

  1. If active exploitation is confirmed or strongly suspected, immediately isolate the Langflow host or container from external network access by modifying firewall rules or security group policies to block inbound connections except from known-good management IPs.
  2. Implement an emergency WAF rule or reverse proxy configuration to enforce strict Origin header validation, rejecting requests where the Origin does not match the expected Langflow host, as an interim measure until the application is patched to v1.9.3 or later.
  3. Revoke or rotate any API keys, authentication tokens, or credentials that may have been exposed to or used within Langflow flows during the suspected exploitation window.

Evidence Collection

  1. Collect and preserve the full web server access logs (Nginx/Apache/IIS) for the affected Langflow instance covering at least 72 hours prior to detection, capturing all request URIs, source IPs, HTTP methods, response codes, and header values.
  2. Export Langflow application-level logs and any database records (flow definitions, execution history, component credentials) to determine what data was accessed, what flows were executed, and whether any custom components or scripts were injected.

Escalation Criteria

  • !Escalate immediately to incident response if Langflow flows containing credentials, API keys, or connections to production systems (databases, cloud APIs, code repositories) were executed during the suspicious activity window.
  • !Escalate if the attacking IP is associated with known threat actors, appears in threat intelligence feeds, or if the attack pattern shows signs of automated scanning followed by targeted exploitation, suggesting a coordinated campaign rather than opportunistic scanning.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST/PUT/DELETE requests to /api/v1/ or /api/v2/ endpoints with absent, empty, or 'null' Referer/Origin headers and successful (2xx) response codes
  • >Langflow application database or configuration files containing flow definitions that may have been read, modified, or executed by an unauthorized actor
  • >Network flow records showing outbound connections initiated from the Langflow host to external IPs following the origin bypass requests, potentially indicating data exfiltration or C2 callback via executed flows

Tuning Guidance

Start by filtering to confirmed Langflow hostnames or IP addresses to reduce noise from unrelated web applications. Raise the request count threshold (currently 3) if your environment has legitimate API clients that intermittently omit Referer headers — consider increasing to 10+ for high-volume environments. Add known-good internal IP ranges (CI/CD servers, monitoring systems, developer workstations) to an allowlist to reduce false positives. For environments where Langflow is deployed internally only, any external source IP in these queries should be treated as critical severity. Consider correlating with Langflow application-level logs to confirm flow execution occurred, not just API endpoint access.

Hunting Queries

Threat hunt for persistent or recurring origin bypass attempts against Langflow over the past 7 days, identifying source IPs with repeated access patterns that may indicate sustained exploitation or reconnaissance activity.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated >= ago(7d)
| where csUriStem has_any ("/api/v1/", "/api/v2/", "/flows", "/run", "/build")
| where csMethod in ("POST", "PUT", "DELETE", "PATCH")
| where isempty(csRefererHeader) or csRefererHeader == "null"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count(), Endpoints=make_set(csUriStem) by csClientIP, csUserAgent
| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)
| where DaySpan >= 1 or RequestCount >= 10
| order by RequestCount desc
Hunting — SPL
spl 
index=web earliest=-7d
| search uri_path IN ("/api/v1/*", "/api/v2/*", "/flows*", "/run*", "/build*")
| where http_method IN ("POST","PUT","DELETE","PATCH")
| where isnull(http_referer) OR http_referer="" OR http_referer="null"
| stats count AS requests, dc(uri_path) AS unique_endpoints, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, http_user_agent
| eval duration_hours=round((last_seen-first_seen)/3600,1)
| where requests>=10 OR duration_hours>=24
| sort -requests

Atomic Red Team Tests

Test 1 CVE-2025-34291 - Missing Origin Header Flow Execution
linux

Simulates an attacker sending a POST request to the Langflow run endpoint without an Origin or Referer header to test origin validation bypass. This represents the simplest exploitation pattern for CVE-2025-34291.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/run/FLOW_ID \
  -H 'Content-Type: application/json' \
  --no-referer \
  -d '{"input_value": "test", "input_type": "chat", "output_type": "chat"}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
No persistent changes; the flow execution result is ephemeral. Review Langflow execution logs to confirm the test was recorded.

Expected Telemetry

Web server access log entry with POST to /api/v1/run/FLOW_ID, empty Referer field, HTTP 200 response code, source IP of test machine

Expected Detection

Alert fires on the KQL/SPL/EQL queries due to successful POST request to Langflow API path with missing Referer header

Test 2 CVE-2025-34291 - Null Origin Header Bypass Attempt
linux

Tests origin validation by sending a request with the Origin header explicitly set to 'null', a known bypass technique where some implementations incorrectly validate the literal string 'null' as a permitted origin.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/flows \
  -H 'Content-Type: application/json' \
  -H 'Origin: null' \
  -H 'Referer: null' \
  -d '{"name": "test-flow", "description": "atomic test", "data": {}}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
Delete any test flow created: curl -X DELETE http://LANGFLOW_HOST:7860/api/v1/flows/CREATED_FLOW_ID

Expected Telemetry

Web server log showing POST to /api/v1/flows with Origin: null and Referer: null headers, response code 200 or 201

Expected Detection

Detection rule triggers on 'Null Origin Bypass' classification due to Origin/Referer value being the string 'null'

Test 3 CVE-2025-34291 - Cross-Origin Mismatch API Access
linux

Simulates a cross-origin request where the attacker's domain is used as the Referer/Origin, bypassing naive same-origin checks if the application fails to properly validate the origin against the expected host.

Command

bash 
curl -s -X POST http://LANGFLOW_HOST:7860/api/v1/build/FLOW_ID/flow \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://attacker-controlled-domain.example.com' \
  -H 'Referer: http://attacker-controlled-domain.example.com/exploit' \
  -d '{"data": {}}' \
  -w '\nHTTP Status: %{http_code}\n'

Cleanup

bash 
No persistent state changes expected from a build endpoint probe. Verify in Langflow logs that no flow was permanently modified.

Expected Telemetry

Web server log entry with POST to /api/v1/build/ path, Origin and Referer headers showing external domain not matching Langflow host, response code 200-204

Expected Detection

Detection rule triggers on 'Cross-Origin Mismatch' classification where Referer domain does not match the destination host of the Langflow instance

Test 4 CVE-2025-34291 - Automated Flow Enumeration Without Origin
linux

Simulates an attacker enumerating available Langflow flows via the API without proper Origin headers, which may be a precursor step before targeting specific high-value flows for execution.

Command

bash 
for endpoint in /api/v1/flows /api/v1/flows?page_size=100 /api/v1/components /api/v1/variables; do
  echo "Testing: $endpoint"
  curl -s -X GET http://LANGFLOW_HOST:7860$endpoint \
    --no-referer \
    -H 'Accept: application/json' \
    -w 'Status: %{http_code}\n' | python3 -m json.tool --no-ensure-ascii 2>/dev/null | head -20
  sleep 1
done

Cleanup

bash 
No modifications made — read-only enumeration. Flush any authentication tokens or session data used during testing.

Expected Telemetry

Multiple GET requests to Langflow API endpoints within short timeframe from same source IP, all with empty Referer, varying response codes depending on authentication state

Expected Detection

May trigger on volume-based thresholds; primary detection value is in establishing reconnaissance baseline before write-operation exploitation detected by other atomic tests

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1552Unsecured Credentials

Same Tactic: Initial Access

Popular Detections