CVE-2026-55255KEV · OVERDUECWE-639

Langflow Authorization Bypass Through User-Controlled Key Vulnerability

High · published June 23, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.4. It is confirmed in active exploitation. It sits in the 58.9th percentile for exploit probability.

106
days past CISA
deadline
CVSS v3.1
8.4
EPSS
1%
Percentile
58.9
In the wild
Confirmed
What it is

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00887 · 58.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-23T21:17Z
KEV added
2026-07-07 · due 2026-07-10
Affected products (1)
ProductVersionsFixed in
langflow/langflow< 1.9.11.9.1
References (6)
https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e · [email protected]https://github.com/langflow-ai/langflow/pull/12832 · [email protected]https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 · [email protected]https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 JUL 00:00Z
    Added to CISA KEV — remediate by Jul 10
    kev
  • 23 JUN 16:28Z
    Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
    cvelistv5