IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows
CISA: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
CVSS 3.1
8.4high
EPSS
<1%p57
Published
()
KEV added
AI analysis
Langflow, an open-source platform for building and deploying AI-powered agents and workflows, contains an authorization bypass (Insecure Direct Object Reference, CWE-639) in its /api/v1/responses endpoint in all versions prior to 1.9.1. An authenticated low-privileged user triggers the flaw by supplying another user's flow ID in the request, causing Langflow to execute that flow without verifying ownership. Because the attacker can run flows belonging to other users on a shared or multi-tenant instance, they can leverage those flows' configured credentials and integrations; public reporting indicates attackers are using the flaw for credential harvesting, which aligns with the flaw's high confidentiality and integrity impact (CVSS 3.1 score 8.4, with scope change). All Langflow deployments running anything earlier than 1.9.1 are affected, with multi-user or shared instances at greatest risk. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-07, confirming exploitation in the wild; ransomware use is currently unknown.
What to do: Upgrade Langflow to 1.9.1 or later immediately, prioritizing internet-facing and multi-user instances, in line with CISA KEV and BOD 26-04 deadlines. If patching must wait, restrict access to /api/v1/responses to trusted users and review logs for requests specifying other users' flow IDs, which may indicate credential harvesting. Per BOD 26-04, evaluate each asset's internet exposure, follow the vendor advisory (GHSA-qrpv-q767-xqq2) for mitigations, and discontinue use where mitigations are unavailable.
Affected
Langflow
all versions prior to 1.9.1 (fixed in 1.9.1)
Estimated exposure
moderatelow thousands of internet-exposed Langflow instances (est.); total self-hosted deployments likely in the tens of thousands — Langflow is a widely adopted open-source AI workflow tool typically self-hosted on internal infrastructure, and public internet scans of Langflow deployments have historically indexed only thousands of exposed servers, while most instances…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
CISA Known Exploited Vulnerability
Affected
Langflow Langflow
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Critical CVSS 9.8 RCE CVE-2026-0768 in Langflow is under active exploitation, with attackers probing for credentials and secrets.
CVE-2026-0768, a critical (CVSS 9.8) remote code execution flaw in Langflow's code validator, lets attackers execute Python code with root privileges via the validate endpoint's code parameter. VulnCheck honeypots in the UK detected Russian-origin exploitation performing reconnaissance and credential harvesting, querying environment variables like LANGFLOW_SUPERUSER and AWS keys and reading Langflow's secret key. Versions before 1.4.2 are affected; no vendor advisory or public PoC was available at reporting time.