CVE-2026-55255

IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows

CISA: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

CVSS 3.1: 8.4 high
EPSS: <1%p59
Published: Jun 23, 2026 · Jun 23, 2026
Added to KEV: Jul 7, 2026

Analyze CVE-2026-55255 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Langflow, an open-source platform for building and deploying AI-powered agents and workflows, contains an authorization bypass (Insecure Direct Object Reference, CWE-639) in its /api/v1/responses endpoint in all versions prior to 1.9.1. An authenticated low-privileged user triggers the flaw by supplying another user's flow ID in the request, causing Langflow to execute that flow without verifying ownership. Because the attacker can run flows belonging to other users on a shared or multi-tenant instance, they can leverage those flows' configured credentials and integrations; public reporting indicates attackers are using the flaw for credential harvesting, which aligns with the flaw's high confidentiality and integrity impact (CVSS 3.1 score 8.4, with scope change). All Langflow deployments running anything earlier than 1.9.1 are affected, with multi-user or shared instances at greatest risk. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-07-07, confirming exploitation in the wild; ransomware use is currently unknown.

What to do: Upgrade Langflow to 1.9.1 or later immediately, prioritizing internet-facing and multi-user instances, in line with CISA KEV and BOD 26-04 deadlines. If patching must wait, restrict access to /api/v1/responses to trusted users and review logs for requests specifying other users' flow IDs, which may indicate credential harvesting. Per BOD 26-04, evaluate each asset's internet exposure, follow the vendor advisory (GHSA-qrpv-q767-xqq2) for mitigations, and discontinue use where mitigations are unavailable.

Product	Affected
Langflow	all versions prior to 1.9.1 (fixed in 1.9.1)

Estimated exposure

moderatelow thousands of internet-exposed Langflow instances (est.); total self-hosted deployments likely in the tens of thousands — Langflow is a widely adopted open-source AI workflow tool typically self-hosted on internal infrastructure, and public internet scans of Langflow deployments have historically indexed only thousands of exposed servers, while most instances…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

KEVCISA Known Exploited Vulnerability

Affected: Langflow Langflow
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due date: Jul 10, 2026
Ransomware use: Unknown