CVE-2026-55255

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

HIGH

8.4

CVSS Score

Published: June 23, 2026 at 04:28 PM UTC

Updated: October 25, 2026 at 11:10 PM UTC

2 products affected across 2 vendorsLangflowLangflow

Using langflow by langflow-ai?

Get instant alerts when new vulnerabilities affect langflow - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.4

Exploitation

CISA KEV

Exploit prediction

EPSS 0.9%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score0.9%

EPSS (Exploit Prediction Scoring System) estimates a 0.9% chance this CVE is exploited in the wild within the next 30 days — higher than 59% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Ransomware Use

Unknown

Added to KEV

Jul 7, 2026

Remediation Due

Jul 10, 2026

114 days overdue

Notes

https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2

BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk

Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk

https://nvd.nist.gov/vuln/detail/CVE-2026-55255

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.2.