CVE-2026-55255

Published: Jun 23, 2026Modified: Jul 8, 2026CISA KEV

8.4

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Exploitability: 1.8 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Affected (1)

Products: Langflow: Langflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langflow Langflow	Before 1.9.1

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (6)

https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e

Source: security-advisories@github.com

Patch

https://github.com/langflow-ai/langflow/pull/12832

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.