CVE-2026-55255 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-23

Added to CISA KEV: 2026-07-07 14 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs for unusual activity on /api/v1/responses, check for cross-user flow execution, and audit for credential exfiltration.
Immediately upgrade Langflow to version 1.9.1 or later, which fixes the IDOR authorization check.
Rotate all secrets embedded in Langflow flows (LLM API keys, cloud credentials, database secrets) as they may have been harvested during exploitation.
Restrict Langflow API/UI access via network-level controls (VPN, firewall, IP allowlisting) and enforce least-privilege user accounts. Monitor and alert on unauthorized or anomalous flow execution requests.
Patch priority: URGENT / EMERGENCY — KEV-listed, actively exploited, high impact.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Langflow, a popular platform for building and deploying AI-powered agents and workflows. The flaw exists in the `/api/v1/responses` endpoint, which fails to properly verify object-level authorization for requests. This vulnerability matters significantly because it allows an authenticated attacker to trigger the execution of any AI flow belonging to another user, potentially leading to unauthorized data access, the leakage of embedded credentials (such as LLM API keys and cloud secrets), and the execution of arbitrary AI workflows within the victim's environment.

Exploitation

Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild, with reports of attackers leveraging it for credential harvesting and unauthorized access to AI workflows ^[1]^[3].
Threat Actors: The flaw has been linked to campaigns focused on stealing sensitive information, including Large Language Model (LLM) keys, cloud service credentials, and database secrets stored within Langflow workflows ^[1].
Availability: While specific automated exploit scripts may be circulating in threat actor communities, the method of exploitation is well-documented in technical advisories and security research blogs ^[2].
Prerequisites:

- Authentication: Required; the attacker must have a valid user account on the affected Langflow instance. - Network: Network-accessible; the attacker must be able to reach the API endpoint. - User Interaction: None required once the attacker has authenticated access to the system.

Affected Products & Patches

Affected Versions: All Langflow versions prior to 1.9.1 are vulnerable ^[4]^[5].
Patch Availability: The vulnerability was resolved in version 1.9.1 ^[4].
Mitigations: Organizations unable to update immediately should restrict access to the Langflow API via network-level controls (e.g., VPNs or firewalls) and implement strict monitoring for unauthorized activity on the `/api/v1/responses` endpoint ^[1].

Impact

Successful Exploitation: Provides an attacker the capability to trigger and execute any flow within the system, regardless of whether they own that flow. This allows them to bypass intended access controls and misuse the functional capabilities of the victim’s AI workflows.
Business Risk: For internet-facing deployments, this poses a severe risk of data breach and supply chain compromise. Attackers can harvest highly sensitive credentials used by AI agents to connect to internal databases, cloud infrastructure, or third-party services, potentially leading to widespread lateral movement and unauthorized exfiltration of corporate data ^[1].

Sources

CVE-2026-55255: Langflow IDOR now on CISA's KEV list
Langflow IDOR (CVE-2026-55255) is exploited to steal LLM keys, cloud credentials and DB secrets. Detection, hardening and NIS2/DORA ...
Understanding Langflow CVE-2026-55255, and why ...
On June 25, 2026, the Sysdig Threat observed the first known active exploitation of a CVSS 9.9 "critical" Langflow vulnerability, tracked as ...
Attackers using Langflow flaw for credential harvesting ...
CISA is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild.
CVE-2026-55255 - Vulnerability Details - OpenCVE
Langflow is a tool for building and deploying AI‑powered agents and workflows. Prior to release 1.9.1, its /api/v1/responses endpoint contains an IDOR flaw (CWE‑639) that allows an authenticated attacker to specify another user’s flow ID and trigger its execution. This vulnerability is fixed in vers…
NVD-CVE-2026-55255
CVE-2026-55255 Detail Description Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by sp…

🔴 CVE-2026-55255