CVE-2026-55255

Published Jun 23, 2026

Last updated 6 days ago

Cloud

HTTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) vulnerability found in Langflow, an open-source tool designed for building and deploying AI-powered agents and workflows. This flaw affects all versions of Langflow prior to 1.9.2. The vulnerability resides in the `/api/v1/responses` endpoint. It allows an authenticated attacker to execute any flow belonging to another user by providing the victim's flow identifier in the request. This is due to a missing ownership check, where the system fails to verify that the requesting user is authorized to invoke the specified flow. The issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

Description: Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
Source: security-advisories@github.com
NVD status: Analyzed
Products: langflow

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.4
Impact score: 6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Exploit added on: Jul 7, 2026
Exploit action due: Jul 10, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

security-advisories@github.com: CWE-639

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E5C0C925-9B95-4B10-BACE-5BBE5A9D24C5",
            "versionEndExcluding": "1.9.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.