CVE-2026-55255

Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Langflow

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

23. Jun 2026

Ausgewertete Quellen

• Hinweis
  https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255
• CISA
  Langflow Authorization Bypass Through User-Controlled Key Vulnerability
• NVD
  CVE-2026-55255
• GitHub
  https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2