CVE-2026-55255: Langflow IDOR — CRITICAL

Q: Is CVE-2026-55255 actively exploited?

Yes, CVE-2026-55255 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Tue Jul 07 2026 00:00:00 GMT+0000 (Coordinated Universal Time).

Q: How to fix CVE-2026-55255?

1. PATCH IMMEDIATELY: Upgrade to Langflow 1.9.1 — the fix enforces user ownership checks on both UUID and endpoint_name lookup branches, returning 404 (not 403) to avoid flow existence disclosure. 2. INTERIM WORKAROUND: If patching is blocked, restrict /api/v1/responses and /api/v2/workflow to single-tenant deployments or allowlisted IP ranges via reverse proxy deny rules. 3. DETECT: Audit API access logs for /api/v1/responses requests where the authenticated user ID does not match the owner of the referenced flow UUID; alert on any cross-user flow execution pattern. 4. AUDIT: Enumerate all flows and cross-reference execution logs to identify historical unauthorized access prior to patching. 5. ROTATE CREDENTIALS: If any victim flow invoked external services (LLM APIs, databases, cloud resources), rotate those credentials as a precaution.

Q: What systems are affected by CVE-2026-55255?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration platforms, agent frameworks, multi-tenant AI deployments, flow-based AI pipelines, agentic AI systems with tool access.

Q: What is the CVSS score for CVE-2026-55255?

CVE-2026-55255 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 29.05%.

CISO Take

A critical IDOR vulnerability (CVSS 9.9) in Langflow's /api/v1/responses endpoint allows any authenticated user to execute flows owned by other users by simply supplying the victim's flow UUID in the request payload — no additional privileges required beyond a valid account. The scope-change flag in the CVSS vector (S:C) signals cross-tenant blast radius: in any multi-tenant Langflow deployment, every user's proprietary AI workflows, processed data, and LLM API budget are exposed to every authenticated peer. No public exploit code has been released and the vulnerability is absent from CISA KEV, but the documented PoC is a single curl command — trivial for any developer-level attacker. Upgrade to Langflow 1.9.1 immediately; if patching is blocked, lock /api/v1/responses to single-tenant or trusted-IP access via your reverse proxy as an interim control.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Critical exposure in multi-tenant deployments. CVSS 9.9 with Scope Changed means exploitation crosses security boundaries beyond the attacker's own account. Attack Complexity is Low and only Low Privileges (any valid account) are required — near-zero-friction exploitation. The PoC is fully documented in the public security advisory. Although no confirmed in-the-wild exploitation exists, Langflow is widely deployed in enterprise AI orchestration contexts, and agentic flows with tool access (database queries, API calls, file I/O) compound the impact dramatically. Self-hosted single-tenant instances face limited exposure; any shared-platform deployment is fully compromised at the authorization layer.

How does the attack unfold?

Initial Access

Attacker authenticates to the target Langflow deployment using any valid account — trial, free tier, or compromised credentials — gaining a legitimate API key.

AML.T0012

Flow UUID Discovery

Attacker discovers victim flow UUIDs through shared workspace features, exported flow files, network traffic interception in collaborative sessions, or sequential enumeration.

AML.T0006

Exploitation

Attacker posts to /api/v1/responses with the victim's flow UUID as the 'model' field; the unpatched ownership-check omission causes the server to execute the victim's flow and return HTTP 200 with full output.

AML.T0049

Impact

Attacker receives victim flow outputs — sensitive documents, PII, business logic, or gains transitive execution access to databases and external APIs wired into the victim's agentic flow.

AML.T0053

Initial Access

Attacker authenticates to the target Langflow deployment using any valid account — trial, free tier, or compromised credentials — gaining a legitimate API key.

AML.T0012

Flow UUID Discovery

Attacker discovers victim flow UUIDs through shared workspace features, exported flow files, network traffic interception in collaborative sessions, or sequential enumeration.

AML.T0006

Exploitation

Attacker posts to /api/v1/responses with the victim's flow UUID as the 'model' field; the unpatched ownership-check omission causes the server to execute the victim's flow and return HTTP 200 with full output.

AML.T0049

Impact

Attacker receives victim flow outputs — sensitive documents, PII, business logic, or gains transitive execution access to databases and external APIs wired into the victim's agentic flow.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.9.1	`1.9.1`
152.7K Pushed 2d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

29.1%

chance of exploitation in 30 days

Higher than 98% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Actively Exploited

CISA KEV

Sophistication

Trivial

Exploitation Confidence

high

✓ CISA KEV (active exploitation confirmed) — Jul 2026

✓ CISA SSVC: Active exploitation

○ Public PoC indexed (trickest/cve)

○ EPSS exploit prediction: 29%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A Low

What should I do?

5 steps

PATCH IMMEDIATELY

Upgrade to Langflow 1.9.1 — the fix enforces user ownership checks on both UUID and endpoint_name lookup branches, returning 404 (not 403) to avoid flow existence disclosure.
INTERIM WORKAROUND

If patching is blocked, restrict /api/v1/responses and /api/v2/workflow to single-tenant deployments or allowlisted IP ranges via reverse proxy deny rules.
DETECT

Audit API access logs for /api/v1/responses requests where the authenticated user ID does not match the owner of the referenced flow UUID; alert on any cross-user flow execution pattern.
AUDIT

Enumerate all flows and cross-reference execution logs to identify historical unauthorized access prior to patching.
ROTATE CREDENTIALS

If any victim flow invoked external services (LLM APIs, databases, cloud resources), rotate those credentials as a precaution.

What does CISA's SSVC say?

Decision Act

Exploitation active

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Framework Agent AML.T0012 - Valid Accounts AML.T0034 - Cost Harvesting AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system

ISO 42001

A.6.1 - Roles, responsibilities and authorities

NIST AI RMF

MANAGE 2.2 - Risk treatment and response mechanisms

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-55255?

A critical IDOR vulnerability (CVSS 9.9) in Langflow's /api/v1/responses endpoint allows any authenticated user to execute flows owned by other users by simply supplying the victim's flow UUID in the request payload — no additional privileges required beyond a valid account. The scope-change flag in the CVSS vector (S:C) signals cross-tenant blast radius: in any multi-tenant Langflow deployment, every user's proprietary AI workflows, processed data, and LLM API budget are exposed to every authenticated peer. No public exploit code has been released and the vulnerability is absent from CISA KEV, but the documented PoC is a single curl command — trivial for any developer-level attacker. Upgrade to Langflow 1.9.1 immediately; if patching is blocked, lock /api/v1/responses to single-tenant or trusted-IP access via your reverse proxy as an interim control.

Is CVE-2026-55255 actively exploited?

Yes, CVE-2026-55255 is confirmed actively exploited and listed in CISA Known Exploited Vulnerabilities catalog since Tue Jul 07 2026 00:00:00 GMT+0000 (Coordinated Universal Time).

How to fix CVE-2026-55255?

1. PATCH IMMEDIATELY: Upgrade to Langflow 1.9.1 — the fix enforces user ownership checks on both UUID and endpoint_name lookup branches, returning 404 (not 403) to avoid flow existence disclosure. 2. INTERIM WORKAROUND: If patching is blocked, restrict /api/v1/responses and /api/v2/workflow to single-tenant deployments or allowlisted IP ranges via reverse proxy deny rules. 3. DETECT: Audit API access logs for /api/v1/responses requests where the authenticated user ID does not match the owner of the referenced flow UUID; alert on any cross-user flow execution pattern. 4. AUDIT: Enumerate all flows and cross-reference execution logs to identify historical unauthorized access prior to patching. 5. ROTATE CREDENTIALS: If any victim flow invoked external services (LLM APIs, databases, cloud resources), rotate those credentials as a precaution.

What systems are affected by CVE-2026-55255?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration platforms, agent frameworks, multi-tenant AI deployments, flow-based AI pipelines, agentic AI systems with tool access.

What is the CVSS score for CVE-2026-55255?

CVE-2026-55255 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 29.05%.

What is the AI security impact?

Affected AI Architectures

LLM orchestration platformsagent frameworksmulti-tenant AI deploymentsflow-based AI pipelinesagentic AI systems with tool access

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0034 Cost Harvesting

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.2.

Exploitation Scenario

An attacker registers a low-privilege account on a shared enterprise Langflow deployment — or compromises an existing user account via phishing. They enumerate flow UUIDs through shared workspace features, exported flow files, network traffic observation in collaborative sessions, or sequential UUID guessing. Using their own valid API key, the attacker posts to /api/v1/responses with the victim's flow UUID as the 'model' parameter. The unpatched helper executes the flow without validating ownership and returns HTTP 200 with full output. For agentic flows connected to internal databases, S3 buckets, or customer CRM systems, the attacker gains transitive read/write access to all resources the victim's flow can reach — without ever directly authenticating to those downstream systems.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.