---
id: 2026-07-langflow-cve-2026-55255-idor-kev
title: "Langflow CVE-2026-55255 — cross-tenant IDOR chained with CVE-2026-33017 RCE, added to CISA KEV under active exploitation"
date_disclosed: 2026-06-19
last_updated: 2026-07-08
severity: critical
status: active
ecosystems: [pypi, ai-agents, langchain]
tools_affected: [langflow]
tags: [cve, idor, rce, kev, actively-exploited, credential-theft, ai-agents]
---

## TL;DR

**CVE-2026-55255** is an Insecure Direct Object Reference (IDOR) in Langflow's `/api/v1/responses` endpoint: the `get_flow_by_id_or_endpoint_name` helper looks up a flow by UUID without checking that the caller owns it, letting any authenticated user execute another tenant's flow. GitHub rates it CVSS **8.4** (High), though Sysdig's own writeup on the exploitation campaign describes it as a 9.9-class cross-tenant break. **Sysdig's Threat Research Team observed a live campaign starting 2026-06-22** that chains this IDOR with the earlier, already-tracked **[CVE-2026-33017](2026-03-langflow-rce.md)** unauthenticated RCE to steal LLM-provider and AWS keys and deploy follow-on malware. **CISA added CVE-2026-55255 to the Known Exploited Vulnerabilities catalog on 2026-07-07**, giving federal agencies until **2026-07-11** to patch. Fixed in **Langflow 1.9.1**.

## What happened

Langflow — the visual drag-and-drop AI agent/workflow builder already responsible for two other tracked CVEs in this repo ([CVE-2026-33017](2026-03-langflow-rce.md), [CVE-2026-27966](2026-02-langflow-cve-2026-27966-csv-agent-rce.md), and [CVE-2026-5027](2026-06-langflow-cve-2026-5027-path-traversal.md)) — shipped a fourth distinct, independently exploitable flaw.

**The bug:** the `/api/v1/responses` endpoint accepts a `flow_id` and executes the corresponding flow. The lookup helper (`get_flow_by_id_or_endpoint_name`) queries the flow directly from the database by UUID and never verifies that the requesting user actually owns it (CWE-639, Authorization Bypass Through User-Controlled Key). Any authenticated user who can guess or obtain another tenant's flow UUID can trigger that flow's execution — including flows wired to another user's LLM provider keys, database credentials, or internal tool integrations.

**The campaign:** Sysdig's Threat Research Team documented a single operator (IP `45.207.216.55`) returning to an internet-exposed Langflow instance it had first probed three days earlier. On **2026-06-25** it ran a tight, scripted sequence: authentication/application reconnaissance → flow enumeration → the CVE-2026-55255 IDOR to reach cross-tenant flows and harvest LLM-provider and AWS keys → a sustained exploitation loop of **CVE-2026-33017** (the March 2026 unauthenticated RCE, already tracked in this repo) to fetch a second-stage downloader for follow-on malware. Sysdig assesses the actor as opportunistic and financially motivated, using low-sophistication tooling — i.e., commodity credential harvesting for resale or cryptomining, not a targeted operation.

**KEV addition:** CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities catalog on **2026-07-07**, alongside unrelated Adobe and Joomla flaws, triggering a Binding Operational Directive 26-04 remediation deadline of **2026-07-11** for federal civilian agencies.

**Relationship to prior Langflow CVEs tracked here:** this is now the **third actively-exploited Langflow CVE within four months** (March, June, and June again), reinforcing this repo's standing guidance to never expose Langflow directly to the internet and to assume disclosure-to-exploit windows under 24 hours for AI-framework CVEs.

## Am I affected?

```bash
# Check your Langflow version
pip show langflow 2>/dev/null | grep Version
langflow --version 2>/dev/null
```

You are affected if you run **Langflow < 1.9.1** and your instance is reachable by any user who shouldn't have access to other tenants' flows — including any multi-tenant or shared-instance deployment, even one that isn't directly internet-facing.

### IOCs

| Type | Value |
|---|---|
| CVE | `CVE-2026-55255` |
| GHSA | `GHSA-qrpv-q767-xqq2` |
| CVSS | 8.4 (High) per GitHub/NVD; described by Sysdig as a 9.9-class cross-tenant break in practice |
| CWE | CWE-639 (Authorization Bypass Through User-Controlled Key) |
| Affected versions | Langflow < 1.9.1 |
| Fixed version | Langflow 1.9.1 |
| Vulnerable endpoint | `POST /api/v1/responses` |
| Chained with | CVE-2026-33017 (unauthenticated RCE, already tracked) |
| Observed attacker IP | `45.207.216.55` |
| CISA KEV added | 2026-07-07 |
| Federal remediation deadline | 2026-07-11 |
| Exploitation window observed | 2026-06-22 → 2026-06-25 |

## If you are affected

1. **Upgrade Langflow to ≥ 1.9.1 immediately** (and to the latest release if you haven't already patched CVE-2026-5027, which required 1.10.0).
2. **Rotate every credential accessible from any flow on the instance** — not just your own. This bug lets one tenant reach *other* tenants' flows, so a shared/multi-tenant Langflow deployment should treat every configured LLM provider key, database credential, and integration secret as potentially exposed.
3. **Audit logs for cross-tenant flow-execution requests** — look for `/api/v1/responses` calls referencing flow IDs that don't belong to the requesting account.
4. **Treat any instance that also shows signs of CVE-2026-33017 exploitation as fully compromised** — assume RCE occurred and follow [playbooks/if-your-webapp-was-compromised.md](../playbooks/if-your-webapp-was-compromised.md).
5. See [playbooks/rotating-cloud-credentials.md](../playbooks/rotating-cloud-credentials.md).

## Prevention

- **Never expose Langflow directly to the internet**, and don't rely on authentication alone in multi-tenant deployments — enforce object-level authorization checks at the reverse-proxy layer as defense in depth.
- **Pin to a release and update promptly.** This is Langflow's fourth tracked CVE in four months; subscribe to [langflow-ai/langflow releases](https://github.com/langflow-ai/langflow/releases).
- → [prevention/agent-sandboxing.md](../prevention/agent-sandboxing.md)

## Sources

- [GitHub Advisory Database — GHSA-qrpv-q767-xqq2](https://github.com/advisories/GHSA-qrpv-q767-xqq2) — canonical vulnerability description, CVSS 8.4, affected/fixed versions; CVE↔GHSA pairing verified directly.
- [NVD — CVE-2026-55255](https://nvd.nist.gov/vuln/detail/CVE-2026-55255) — canonical CVE record, CVSS vector, CWE-639, references to GitHub advisory and patch PR #12832.
- [Sysdig — Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited](https://www.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited) — primary campaign research; attacker IP, timeline, chained exploitation of CVE-2026-33017, attribution assessment.
- [BleepingComputer — CISA orders feds to prioritize patching Langflow auth bypass flaw](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw/) — KEV addition date, BOD 26-04 deadline, independent summary of Sysdig's findings.
- [The Hacker News — CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV](https://thehackernews.com/2026/07/cisa-adds-4-actively-exploited-adobe.html) — independent corroboration of KEV addition.
- Cross-link: [Langflow CVE-2026-33017 RCE (March 2026)](2026-03-langflow-rce.md), [Langflow CVE-2026-5027 path traversal (June 2026)](2026-06-langflow-cve-2026-5027-path-traversal.md), [JADEPUFFER agentic ransomware](2026-07-jadepuffer-langflow-agentic-ransomware.md) — three other distinct Langflow incidents this repo tracks; this is the fourth.