Vulnerability details
CVE-2026-55255
Actively exploited
langflow-ai langflow
Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow
CVSS 3.1
8.4High
Official description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.4High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| langflow-ai | langflow | < 1.9.1 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://github.com/langflow-ai/langflow/pull/12832 x_refsource_MISC
- https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e x_refsource_MISC
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 x_refsource_CONFIRM
- https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-23
- Last updated
- 2026-10-07
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 68 · High
CISA KEV catalog
- Date added
- 2026-07-07
- Due date
- 2026-07-10
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
0.88%
Probability of exploitation in 30 days
59.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-639Authorization Bypass Through User-Controlled Key