Langflow CVE-2026-55255 — cross-tenant IDOR chained with CVE-2026-33017 RCE, added to CISA KEV under active exploitation

TL;DR

CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) in Langflow's /api/v1/responses endpoint: the get_flow_by_id_or_endpoint_name helper looks up a flow by UUID without checking that the caller owns it, letting any authenticated user execute another tenant's flow. GitHub rates it CVSS 8.4 (High), though Sysdig's own writeup on the exploitation campaign describes it as a 9.9-class cross-tenant break. Sysdig's Threat Research Team observed a live campaign starting 2026-06-22 that chains this IDOR with the earlier, already-tracked CVE-2026-33017 unauthenticated RCE to steal LLM-provider and AWS keys and deploy follow-on malware. CISA added CVE-2026-55255 to the Known Exploited Vulnerabilities catalog on 2026-07-07, giving federal agencies until 2026-07-11 to patch. Fixed in Langflow 1.9.1.

What happened

Langflow — the visual drag-and-drop AI agent/workflow builder already responsible for two other tracked CVEs in this repo (CVE-2026-33017, CVE-2026-27966, and CVE-2026-5027) — shipped a fourth distinct, independently exploitable flaw.

The bug: the /api/v1/responses endpoint accepts a flow_id and executes the corresponding flow. The lookup helper (get_flow_by_id_or_endpoint_name) queries the flow directly from the database by UUID and never verifies that the requesting user actually owns it (CWE-639, Authorization Bypass Through User-Controlled Key). Any authenticated user who can guess or obtain another tenant's flow UUID can trigger that flow's execution — including flows wired to another user's LLM provider keys, database credentials, or internal tool integrations.

The campaign: Sysdig's Threat Research Team documented a single operator (IP 45.207.216.55) returning to an internet-exposed Langflow instance it had first probed three days earlier. On 2026-06-25 it ran a tight, scripted sequence: authentication/application reconnaissance → flow enumeration → the CVE-2026-55255 IDOR to reach cross-tenant flows and harvest LLM-provider and AWS keys → a sustained exploitation loop of CVE-2026-33017 (the March 2026 unauthenticated RCE, already tracked in this repo) to fetch a second-stage downloader for follow-on malware. Sysdig assesses the actor as opportunistic and financially motivated, using low-sophistication tooling — i.e., commodity credential harvesting for resale or cryptomining, not a targeted operation.

KEV addition: CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities catalog on 2026-07-07, alongside unrelated Adobe and Joomla flaws, triggering a Binding Operational Directive 26-04 remediation deadline of 2026-07-11 for federal civilian agencies.

Relationship to prior Langflow CVEs tracked here: this is now the third actively-exploited Langflow CVE within four months (March, June, and June again), reinforcing this repo's standing guidance to never expose Langflow directly to the internet and to assume disclosure-to-exploit windows under 24 hours for AI-framework CVEs.

Am I affected?

# Check your Langflow version
pip show langflow 2>/dev/null | grep Version
langflow --version 2>/dev/null

You are affected if you run Langflow < 1.9.1 and your instance is reachable by any user who shouldn't have access to other tenants' flows — including any multi-tenant or shared-instance deployment, even one that isn't directly internet-facing.

IOCs

If you are affected

1. Upgrade Langflow to ≥ 1.9.1 immediately (and to the latest release if you haven't already patched CVE-2026-5027, which required 1.10.0).
2. Rotate every credential accessible from any flow on the instance — not just your own. This bug lets one tenant reach other tenants' flows, so a shared/multi-tenant Langflow deployment should treat every configured LLM provider key, database credential, and integration secret as potentially exposed.
3. Audit logs for cross-tenant flow-execution requests — look for /api/v1/responses calls referencing flow IDs that don't belong to the requesting account.
4. Treat any instance that also shows signs of CVE-2026-33017 exploitation as fully compromised — assume RCE occurred and follow playbooks/if-your-webapp-was-compromised.md.
5. See playbooks/rotating-cloud-credentials.md.

Prevention

• Never expose Langflow directly to the internet, and don't rely on authentication alone in multi-tenant deployments — enforce object-level authorization checks at the reverse-proxy layer as defense in depth.
• Pin to a release and update promptly. This is Langflow's fourth tracked CVE in four months; subscribe to langflow-ai/langflow releases.
• → prevention/agent-sandboxing.md

Sources

• GitHub Advisory Database — GHSA-qrpv-q767-xqq2 — canonical vulnerability description, CVSS 8.4, affected/fixed versions; CVE↔GHSA pairing verified directly.
• NVD — CVE-2026-55255 — canonical CVE record, CVSS vector, CWE-639, references to GitHub advisory and patch PR #12832.
• Sysdig — Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited — primary campaign research; attacker IP, timeline, chained exploitation of CVE-2026-33017, attribution assessment.
• BleepingComputer — CISA orders feds to prioritize patching Langflow auth bypass flaw — KEV addition date, BOD 26-04 deadline, independent summary of Sysdig's findings.
• The Hacker News — CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV — independent corroboration of KEV addition.
• Cross-link: Langflow CVE-2026-33017 RCE (March 2026), Langflow CVE-2026-5027 path traversal (June 2026), JADEPUFFER agentic ransomware — three other distinct Langflow incidents this repo tracks; this is the fourth.