CVE-2026-55255highunder attackCWE-639

CVE-2026-55255: high-severity vulnerability in langflow-ai langflow

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Published · Updated

Follow this CVE+ Monitor langflow+ Monitor Langflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.4epss 0.9%
from disclosure to weapon7 days
Published on NVDJun 23
1st PoC+7d
CISA KEV+14d
Action required by CISAfederal deadline: 2026-07-10

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

Langflow has a flaw where logged-in users can access and run AI workflows belonging to other users by guessing or knowing their workflow ID. This allows attackers to execute someone else's automation without permission.

Technical detail

An IDOR vulnerability in the /api/v1/responses endpoint fails to validate user ownership of flow resources, allowing authenticated attackers to execute arbitrary flows by manipulating the flow ID parameter. The vulnerability requires valid authentication but no additional privileges, with impact extending to unauthorized workflow execution and potential data exfiltration through victim flows.

Summary generated and translated by AI from the official description.
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
langflow-ai · langflow
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — langflow-ai langflow

In the same product, most dangerous first.

CVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 96.4%KEVCVE-2026-5027HIGHLangflow - Path Traversal Arbitrary File Write via upload_user_fileEPSS 40.0%CVE-2026-27966CRITICALLangflow has Remote Code Execution in CSV AgentEPSS 35.2%CVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2026-33497HIGHLangflow: /profile_pictures/{folder_name}/{file_name} endpoint file readingEPSS 19.6%