CVE-2026-55423: Langflow logout fails to clear

Q: Is CVE-2026-55423 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55423, increasing the risk of exploitation.

Q: How to fix CVE-2026-55423?

1. Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup. 2. Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close. 3. Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched. 4. Network scope: Ensure Langflow is not reachable from shared, public, or guest networks. 5. Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

Q: What systems are affected by CVE-2026-55423?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, agent frameworks, multi-user AI development environments.

Q: What is the CVSS score for CVE-2026-55423?

CVE-2026-55423 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.19%.

CISO Take

Langflow's `/logout` endpoint deleted auth cookies with mismatched parameters (httponly/samesite/secure/domain), causing browsers to silently retain `access_token_lf` and `refresh_token_lf` after logout; the frontend also failed to wipe them from Local Storage. In shared-workstation environments — AI labs, SOC consoles, developer hotdesks — an attacker with physical access can simply refresh the browser and inherit a previous user's full authenticated session, accessing configured LLM API keys, AI pipeline definitions, and any data processed by Langflow. With CVSS AV:P (physical access required), no public exploit, and no CISA KEV listing, this is not an emergency for air-gapped or single-user deployments, but any multi-user Langflow installation should treat it as P1. Upgrade to Langflow 1.7.0 immediately; until patched, instruct users to manually clear browser cookies and localStorage and restrict Langflow to non-shared machines.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity with context-dependent impact. The CVSS AV:P vector confines exploitation to scenarios with physical or local browser access after a legitimate logout, but Langflow manages high-value AI assets — LLM API credentials, agentic workflow configurations, and sensitive pipeline data — which amplifies the consequence of even a low-friction session takeover. The package carries a 77/100 risk score and 53 cumulative CVEs, signaling a pattern of security debt warranting organizational risk review beyond this single finding. No public PoC or active exploitation detected.

How does the attack unfold?

Physical Access

Attacker sits down at a shared workstation after a legitimate Langflow user has clicked the logout button, believing their session is terminated.

AML.T0041

Session Persistence

Browser retains access_token_lf and refresh_token_lf in cookies and Local Storage because the /logout endpoint used mismatched cookie deletion parameters and the frontend performed no client-side cleanup.

AML.T0091.000

Unauthorized Access

Attacker navigates to the Langflow URL and is automatically re-authenticated as the previous user with no credentials required — a page refresh suffices.

AML.T0012

Credential & Pipeline Exfiltration

Attacker extracts LLM API keys, vector database credentials, and proprietary pipeline/prompt configurations accessible through the inherited Langflow session.

AML.T0025

Physical Access

Attacker sits down at a shared workstation after a legitimate Langflow user has clicked the logout button, believing their session is terminated.

AML.T0041

Session Persistence

Browser retains access_token_lf and refresh_token_lf in cookies and Local Storage because the /logout endpoint used mismatched cookie deletion parameters and the frontend performed no client-side cleanup.

AML.T0091.000

Unauthorized Access

Attacker navigates to the Langflow URL and is automatically re-authenticated as the previous user with no credentials required — a page refresh suffices.

AML.T0012

Credential & Pipeline Exfiltration

Attacker extracts LLM API keys, vector database credentials, and proprietary pipeline/prompt configurations accessible through the inherited Langflow session.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	< 1.7.0	`1.7.1`
152.7K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Physical

AC Low

PR None

UI None

S Unchanged

C High

I High

A None

What should I do?

5 steps

Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup.
Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close.
Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched.
Network scope: Ensure Langflow is not reachable from shared, public, or guest networks.
Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Framework Agent AML.T0012 - Valid Accounts AML.T0055 - Unsecured Credentials AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI System Access Control

NIST AI RMF

MANAGE-2.4 - Residual Risk Response

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-55423?

Langflow's `/logout` endpoint deleted auth cookies with mismatched parameters (httponly/samesite/secure/domain), causing browsers to silently retain `access_token_lf` and `refresh_token_lf` after logout; the frontend also failed to wipe them from Local Storage. In shared-workstation environments — AI labs, SOC consoles, developer hotdesks — an attacker with physical access can simply refresh the browser and inherit a previous user's full authenticated session, accessing configured LLM API keys, AI pipeline definitions, and any data processed by Langflow. With CVSS AV:P (physical access required), no public exploit, and no CISA KEV listing, this is not an emergency for air-gapped or single-user deployments, but any multi-user Langflow installation should treat it as P1. Upgrade to Langflow 1.7.0 immediately; until patched, instruct users to manually clear browser cookies and localStorage and restrict Langflow to non-shared machines.

Is CVE-2026-55423 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55423, increasing the risk of exploitation.

How to fix CVE-2026-55423?

1. Patch: Upgrade to Langflow 1.7.0 or later — PRs #10527 and #10528 fix cookie deletion to match creation parameters and add frontend session cleanup. 2. Workaround (if unable to patch): Mandate that users manually clear browser cookies and localStorage after each session; consider a browser extension policy to auto-wipe on tab close. 3. Access restriction: Deploy Langflow exclusively on dedicated, single-user machines until patched. 4. Network scope: Ensure Langflow is not reachable from shared, public, or guest networks. 5. Detection: Review server access logs for sessions that remain active well beyond expected user activity windows or that resume without a preceding login event.

What systems are affected by CVE-2026-55423?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, agent frameworks, multi-user AI development environments.

What is the CVSS score for CVE-2026-55423?

CVE-2026-55423 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationagent frameworksmulti-user AI development environments

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0055 Unsecured Credentials

AML.T0091.000 Application Access Token

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.4

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user stays logged in unless another user explicitly logs in. This vulnerability is fixed in 1.7.0.

Exploitation Scenario

An attacker waits for a colleague to finish using a shared workstation running Langflow and click 'Logout.' Because the `/logout` endpoint uses mismatched cookie attributes, the browser ignores the deletion directive and retains both `access_token_lf` and `refresh_token_lf`. The attacker opens the same browser, navigates to the Langflow URL, and is automatically authenticated as the previous user — no credentials required, no visible anomaly in the UI. The attacker then navigates to pipeline settings to harvest LLM provider API keys, exports workflow definitions containing proprietary prompt logic, or modifies existing pipelines to insert a data exfiltration step that silently copies processed documents to an external endpoint on future runs.

Weaknesses (CWE)

CWE-613 Insufficient Session Expiration Primary CWE-613 Insufficient Session Expiration Primary CWE-613 Insufficient Session Expiration

CWE-613 — Insufficient Session Expiration: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."