VULNERABILITY INTELLIGENCE

CVE-2026-55255

CVSS score8.4 HIGH

EPSS probability0.89%

CISA KEVKnown exploited vulnerability

Published2026-06-23

Last modified2026-10-25

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

Known Exploited Vulnerability

Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Vendor / product: Langflow / Langflow

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Weakness classification

security-advisories@github.com: CWE-639

Primary references

security-advisories@github.com — Patch
security-advisories@github.com — Issue Tracking, Patch
security-advisories@github.com — Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource