Langflow is a tool for building and deploying AI-powered agents and workflows.
CVE-2026-55255 Exploited
Summary Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Details The vulnerability exists in the getflowbyidorendpointname helper function in [src/backend/base/langflow/helpers/flow.py (lines 399-414)](https://github.com/langflow-ai/langflow/blob/v1.9.0/src/backend/base/langflow/helpers/flow.py#L399C1-L414C67). When a flow is accessed via UUID (flowid), the function queries the database directly without verifying if the authenticated user owns that flow: python src/backend/base/langflow/helpers/flow.py:399-414 async def getflowbyidorendpointname(flowidorname: str, userid: str | UUID | None = None) -> FlowRead: async with sessionscope() as session: try: flowid = UUID(flowidorname) When using UUID, query directly WITHOUT checking userid flow = await session.get(Flow, flowid) # ❌ No userid check! except ValueError: endpointname = flowidorname stmt = select(Flow).where(Flow.endpointname == endpointname) Only when using endpointname is userid checked if userid: stmt = stmt.where(Flow.userid == uuiduserid) This function is…
Being exploited in the wild
Catalogued 7 July 2026 · US federal remediation deadline 10 July 2026
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for…
Exploit code is also public: Public PoC
- Public PoCrootdirective-sec/CVE-2026-55255-Lab
Part of the AI stack
This affects Langflow, in Agent frameworks.
Assessment
- CVSS
- 8.4 (v3.1)
- Severity
- High
- EPSS
- 0.89% chance of exploitation in the next 30 days
- Known exploited
- Yes — listed in the CISA KEV catalog
- Exploit availability
- CISA KEV, Public PoC
- Published
- 19 June 2026
- Last updated
- 25 October 2026
- Affected
- Langflow · langflow-ai · Langflow · langflow · langflow
- Weakness
- CWE-639
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
At the source
References
- https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e
- https://github.com/langflow-ai/langflow/pull/12832
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
- https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://nvd.nist.gov/vuln/detail/CVE-2026-55255
- https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2026-221.yaml
- https://github.com/advisories/GHSA-qrpv-q767-xqq2
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-55255