CVE-2026-55423: medium-severity vulnerability in langflow-ai langflow
Langflow: Logout button does not clear session
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
exploitation probability
0.2%top 88% of all CVEs
observed exploitation
nono source reports it
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
langflow-ai · langflowRelated CVEs — langflow-ai langflow
In the same product, most dangerous first.
CVE-2025-3248CRITICALLangflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codeEPSS 100.0%KEVCVE-2026-33017CRITICALLangflow has Unauthenticated Remote Code Execution via Public Flow Build EndpointEPSS 24.8%KEVCVE-2026-55255HIGHLangflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's FlowEPSS 0.9%KEVCVE-2026-21445HIGHLangflow Missing Authentication on Critical API EndpointsEPSS 33.3%CVE-2025-68477HIGHLangflow vulnerable to Server-Side Request ForgeryEPSS 6.3%CVE-2025-68478HIGHLangflow Vulnerable to External Control of File Name or PathEPSS 5.8%