Vulnerabilities3 min read
MuddyWater Exploits Langflow Flaw for Initial Access
CISA adds CVE-2025-34291 to KEV after Iranian APT MuddyWater weaponizes the CORS/CSRF chain for account takeover and RCE. CVSS 9.4 flaw requires only a malicious link click.
Marcus ChenMay 24, 2026