SECURELYN
Free ScanFree consultation

CVE-2026-55255

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

Scores

8.4
CVSS 8.4 out of 10, high severity.
0.9%
EPSS 0.9% chance of exploitation in the next 30 days.

The facts

Published
23 June 2026
Last changed
7 October 2026
NVD status
Analyzed
Severity
High, CVSS 8.4 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Weakness
Affects
  • langflow langflow
Known exploited
Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 7 July 2026.
EPSS
0.9% chance of exploitation activity in the next 30 days (percentile 59).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References