Vulnerability Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Langflow | Langflow | < 1.9.1 |
Related Weaknesses (CWE)
References
- https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625Patch
- https://github.com/langflow-ai/langflow/pull/12832Issue TrackingPatch
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2ExploitMitigationVendor Advisory
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2ExploitMitigationVendor Advisory
- https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-hiThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
FAQ
What is CVE-2026-55255?
CVE-2026-55255 is a vulnerability with a CVSS score of 8.4 (HIGH). Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenti...
How severe is CVE-2026-55255?
CVE-2026-55255 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55255?
Check the references section above for vendor advisories and patch information. Affected products include: Langflow Langflow.