CVE-2026-55255NVD

Vulnerability Summary

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Severity Level

HIGH(8.4)

Published Date

Jun 23, 2026

Last Modified

Jul 8, 2026

Exploitation Status

ACTIVE

EPSS Score (30-Day)

29.05%Probability

Root Weakness (CWE)

CWE-639: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredLow

User InteractionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityLow

External References

https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e
https://github.com/langflow-ai/langflow/pull/12832
https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255

Critical Alert 1 Active Exploit Detected Today

CVE Watchtower

CVE-2026-55255NVD

Vulnerability Summary

External References