CVE-2026-55423: Langflow logout fails to clear

Q: Is CVE-2026-55423 actively exploited?

No confirmed active exploitation of CVE-2026-55423 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55423?

1. Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup. 2. Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close. 3. Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched. 4. Network scope: Ensure Langflow is not reachable from shared, public, or guest networks. 5. Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

Q: What systems are affected by CVE-2026-55423?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, agent frameworks, multi-user AI development environments.

Q: What is the CVSS score for CVE-2026-55423?

CVE-2026-55423 has a CVSS v3.1 base score of 6.1 (MEDIUM).

CISO Take

Langflow's `/logout` endpoint deleted auth cookies with mismatched parameters (httponly/samesite/secure/domain), causing browsers to silently retain `access_token_lf` and `refresh_token_lf` after logout; the frontend also failed to wipe them from Local Storage. In shared-workstation environments — AI labs, SOC consoles, developer hotdesks — an attacker with physical access can simply refresh the browser and inherit a previous user's full authenticated session, accessing configured LLM API keys, AI pipeline definitions, and any data processed by Langflow. With CVSS AV:P (physical access required), no public exploit, and no CISA KEV listing, this is not an emergency for air-gapped or single-user deployments, but any multi-user Langflow installation should treat it as P1. Upgrade to Langflow 1.7.0 immediately; until patched, instruct users to manually clear browser cookies and localStorage and restrict Langflow to non-shared machines.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity with context-dependent impact. The CVSS AV:P vector confines exploitation to scenarios with physical or local browser access after a legitimate logout, but Langflow manages high-value AI assets — LLM API credentials, agentic workflow configurations, and sensitive pipeline data — which amplifies the consequence of even a low-friction session takeover. The package carries a 77/100 risk score and 53 cumulative CVEs, signaling a pattern of security debt warranting organizational risk review beyond this single finding. No public PoC or active exploitation detected.

How does the attack unfold?

Physical Access

Attacker sits down at a shared workstation after a legitimate Langflow user has clicked the logout button, believing their session is terminated.

AML.T0041

Session Persistence

Browser retains access_token_lf and refresh_token_lf in cookies and Local Storage because the /logout endpoint used mismatched cookie deletion parameters and the frontend performed no client-side cleanup.

AML.T0091.000

Unauthorized Access

Attacker navigates to the Langflow URL and is automatically re-authenticated as the previous user with no credentials required — a page refresh suffices.

AML.T0012

Credential & Pipeline Exfiltration

Attacker extracts LLM API keys, vector database credentials, and proprietary pipeline/prompt configurations accessible through the inherited Langflow session.

AML.T0025

Physical Access

Attacker sits down at a shared workstation after a legitimate Langflow user has clicked the logout button, believing their session is terminated.

AML.T0041

Session Persistence

Browser retains access_token_lf and refresh_token_lf in cookies and Local Storage because the /logout endpoint used mismatched cookie deletion parameters and the frontend performed no client-side cleanup.

AML.T0091.000

Unauthorized Access

Attacker navigates to the Langflow URL and is automatically re-authenticated as the previous user with no credentials required — a page refresh suffices.

AML.T0012

Credential & Pipeline Exfiltration

Attacker extracts LLM API keys, vector database credentials, and proprietary pipeline/prompt configurations accessible through the inherited Langflow session.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.7.0	`1.7.1`
149.6K Pushed 6d ago 42% patched ~50d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Physical

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

5 steps

Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup.
Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close.
Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched.
Network scope: Ensure Langflow is not reachable from shared, public, or guest networks.
Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

How is it classified?

Auth Bypass Data Extraction Framework Agent AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI System Access Control

NIST AI RMF

MANAGE-2.4 - Residual Risk Response

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-55423?

Langflow's `/logout` endpoint deleted auth cookies with mismatched parameters (httponly/samesite/secure/domain), causing browsers to silently retain `access_token_lf` and `refresh_token_lf` after logout; the frontend also failed to wipe them from Local Storage. In shared-workstation environments — AI labs, SOC consoles, developer hotdesks — an attacker with physical access can simply refresh the browser and inherit a previous user's full authenticated session, accessing configured LLM API keys, AI pipeline definitions, and any data processed by Langflow. With CVSS AV:P (physical access required), no public exploit, and no CISA KEV listing, this is not an emergency for air-gapped or single-user deployments, but any multi-user Langflow installation should treat it as P1. Upgrade to Langflow 1.7.0 immediately; until patched, instruct users to manually clear browser cookies and localStorage and restrict Langflow to non-shared machines.

Is CVE-2026-55423 actively exploited?

No confirmed active exploitation of CVE-2026-55423 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55423?

1. Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup. 2. Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close. 3. Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched. 4. Network scope: Ensure Langflow is not reachable from shared, public, or guest networks. 5. Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

What systems are affected by CVE-2026-55423?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, agent frameworks, multi-user AI development environments.

What is the CVSS score for CVE-2026-55423?

CVE-2026-55423 has a CVSS v3.1 base score of 6.1 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationagent frameworksmulti-user AI development environments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0091.000 Application Access Token

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

### Summary The logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. ### Details Not in auto login mode. Hosted on localhost. `access_token_lf` remains present in both Local Storage and Cookies. `refresh_token_lf` remains present in Cookies. **Root cause:** the `/logout` endpoint deleted the authentication cookies without matching the original `httponly`/`samesite`/`secure`/`domain` parameters, so the browser kept them; additionally the frontend did not clear the auth cookies on logout. ``` LANGFLOW_AUTO_LOGIN: "False" LANGFLOW_SUPERUSER: <set> LANGFLOW_SUPERUSER_PASSWORD: <set> LANGFLOW_SECRET_KEY: <set> LANGFLOW_NEW_USER_IS_ACTIVE: "False" LANGFLOW_ENABLE_SUPERUSER_CLI: "False" ``` ### PoC Click Logout. Hit refresh to return to previous screen. ### Impact Users on shared computers may falsely believe they have terminated their session. ### Patches Fixed in **1.7.0** (PRs #10527 and #10528). The logout endpoint now deletes the auth cookies using the same parameters they were created with, and the frontend clears the auth cookies on logout. Upgrade to **1.7.0 or later**.

Exploitation Scenario

An attacker waits for a colleague to finish using a shared workstation running Langflow and click 'Logout.' Because the `/logout` endpoint uses mismatched cookie attributes, the browser ignores the deletion directive and retains both `access_token_lf` and `refresh_token_lf`. The attacker opens the same browser, navigates to the Langflow URL, and is automatically authenticated as the previous user — no credentials required, no visible anomaly in the UI. The attacker then navigates to pipeline settings to harvest LLM provider API keys, exports workflow definitions containing proprietary prompt logic, or modifies existing pipelines to insert a data exfiltration step that silently copies processed documents to an external endpoint on future runs.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration Primary

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."