Skip to content
Connect AISign inSign up free
CVE-2026-552558.4HighCWE-639

CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Langflow

Vendor fix available · Affected: Langflow · Exploitation: in CISA KEV since 7 Jul

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue7 Jul
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub30 Jun
  5. Not established: not seen
0.9%probability of exploitation in the next 30 days
59th percentile
050100

Higher than 59% of scored CVEs

8.4HighCVSS 3.1
LowHigh

Federal deadline

CISA KEV · added 7 Jul · catalogue entry

Passed 127 days ago

DescriptionNVD

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas
Exploitation
Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
CISA KEV
Listed since 7 Jul · catalogue entry
Public check
No public nuclei template
Weakness
Insecure Direct Object Reference
Vendor
langflow-ai
Published
June 2026
Band
Exploited in the wild, June 2026

What changed

  1. CISA added it to the KEV catalogue CISA
  2. PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage10 articles · 4 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 26 Jun.

Full timeline
Quiet for 18 weekslast report 13 Jul10 articles4 outlets
26 Jun · SecurityOnline first5 Sep29 Sep23 OctNow
  • Fri 26 Jun, 02:20 UTC. SecurityOnline, first report. Critical flaws in Langflow allow data theft and DoS, patch urged. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 18:07 UTC. CISA, its first report on the story. CISA adds critical Langflow auth bypass flaw to KEV list. Cites a CVE in CISA KEV.
  • Tue 7 Jul, 22:31 UTC. CISA. CISA adds critical Langflow auth bypass flaw to KEV list. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 03:31 UTC. SecurityOnline. CISA flags critical Joomla, ColdFusion bugs under attack. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 03:31 UTC. SecurityOnline. Four flaws hit Joomla, Langflow, ColdFusion and Linux today. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 09:21 UTC. Security Affairs, its first report on the story. CISA warns of active exploits in ColdFusion, Joomla page builders. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 10:01 UTC. SecurityOnline. Android Remote Root Exploit Chain Unveiled by Nebula. Cites a CVE in CISA KEV.
  • Wed 8 Jul, 11:08 UTC. SecurityWeek, its first report on the story. CISA alerts on critical ColdFusion Langflow and Joomla flaws. Cites a CVE in CISA KEV.
  • Thu 9 Jul, 05:32 UTC. SecurityOnline. LineageOS Browser Flash Tool Makes ROM Install Easier. Cites a CVE in CISA KEV.
  • Mon 13 Jul, 03:01 UTC. SecurityOnline. CISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs. Cites a CVE in CISA KEV.
All coveragerunning totalAdded to CISA KEV · 7 Jul10SecurityOnl…6CISA2Security Af…1SecurityWeek126 Jun13 Aug30 SepNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
10 articles about CVE-2026-55255 from 4 outlets
Published (UTC)OutletHeadline
26 Jun 02:20SecurityOnlineCritical flaws in Langflow allow data theft and DoS, patch urged
7 Jul 18:07CISACISA adds critical Langflow auth bypass flaw to KEV list
7 Jul 22:31CISACISA adds critical Langflow auth bypass flaw to KEV list
8 Jul 03:31SecurityOnlineCISA flags critical Joomla, ColdFusion bugs under attack
8 Jul 03:31SecurityOnlineFour flaws hit Joomla, Langflow, ColdFusion and Linux today
8 Jul 09:21Security AffairsCISA warns of active exploits in ColdFusion, Joomla page builders
8 Jul 10:01SecurityOnlineAndroid Remote Root Exploit Chain Unveiled by Nebula
8 Jul 11:08SecurityWeekCISA alerts on critical ColdFusion Langflow and Joomla flaws
9 Jul 05:32SecurityOnlineLineageOS Browser Flash Tool Makes ROM Install Easier
13 Jul 03:01SecurityOnlineCISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs
  1. CISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs
    SecurityOnline · mentions it in passing
  2. LineageOS Browser Flash Tool Makes ROM Install Easier
    SecurityOnline · mentions it in passing
  3. CISA alerts on critical ColdFusion Langflow and Joomla flaws
    SecurityWeek · mentions it in passing
  4. Android Remote Root Exploit Chain Unveiled by Nebula
    SecurityOnline · mentions it in passing
  5. CISA warns of active exploits in ColdFusion, Joomla page builders
    Security Affairs · mentions it in passing
  6. Four flaws hit Joomla, Langflow, ColdFusion and Linux today
    SecurityOnline · mentions it in passing
  7. CISA flags critical Joomla, ColdFusion bugs under attack
    SecurityOnline · mentions it in passing
  8. CISA adds critical Langflow auth bypass flaw to KEV list
    CISA · official notice
Show 2 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Sign inSign up free

Updated