CVE-2026-55255

Aliases:GHSA-qrpv-q767-xqq2PYSEC-2026-221
Analyzed
Published: 23 Jun 2026, 16:28
Last modified:08 Jul 2026, 03:56

Vulnerability Summary

Overall Risk (default)
medium
49/100
CVSS Score
8.4 HIGH
v3.1 (cve.org)
EPSS Score
29.05% HIGH
29% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

23 Jun 2026, 16:28
Published
Vulnerability first disclosed
07 Jul 2026, 00:00
Added to CISA KEV
Langflow Authorization Bypass Through User-Controlled Key Vulnerability
08 Jul 2026, 03:56
Last Modified
Vulnerability information updated
10 Jul 2026, 00:00
CISA Remediation Due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

CVSS Metrics

  • v3.1•HIGH•Score: 8.4CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

EPSS Trends

Current EPSS score: 29.05%• Percentile: 98%

Techniques & Countermeasures

  • CWE-639•Authorization Bypass Through User-Controlled Key

    The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Affected Systems

  • langflow-ai•langflow

    < 1.9.2 | < 1.9.1

  • langflow•langflow

    < 1.9.1

  • PyPI•langflow

    < 1.9.2 | < 1.9.1

References (8)