Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder | 9.3 | 96% | KEVPoC ×6 | KEV |
| CVE-2026-55255 | IDOR Authorization Bypass in Langflow Lets Attackers Run Other Users' Flows | 8.4 | <1% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on Tuesday, July 7, nearly two weeks after the Sysdig Threat Research Team observed it being actively targeted.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.