CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

High severity, CVSS 8.4. Actively exploited: in CISA KEV since 2026-07-07. EPSS: 0.9% chance of exploitation in the next 30 days.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Affected products

• Langflow Langflow: before 1.9.1 (fixed in 1.9.1)

Published 2026-06-23. Last modified 2026-10-07.