CVE-2026-55255 in langflow
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
Affected software: langflow
Scores
- CVSS: 8.4 (high)
- EPSS: 0.89% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-07-07
- Published: 2026-06-23
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Langflow for running other users' flows (CVE-2026-55255)
Patch or upgrade. Any logged-in Langflow user can run a flow that belongs to someone else by passing its ID. Upgrading to the fixed release in GHSA-qrpv-q767-xqq2 closes it.
Applies to: Langflow versions listed as affected in GHSA-qrpv-q767-xqq2.
- Check the Langflow version (`langflow --version` or the image tag).
- Upgrade to the fixed version listed in advisory GHSA-qrpv-q767-xqq2 and restart.
- Review which accounts exist and remove ones that are not needed; turn off auto login.
- Rotate API keys and secrets stored in flows that hold credentials.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.