Langflow is the first AI agent platform to be added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. The addition of CVE-2026-55255 on July 7, 2026, triggers a mandatory remediation deadline of July 10, 2026, for federal agencies under binding operational directive BOD 26-04. This directive, issued June 10, 2026, supersedes BOD 19-02 and BOD 22-01. It uses a risk-based tiered framework: 3 days for highest risk (publicly exposed, in KEV, automatable, total system control), 14 days for medium, 60 days for standard.
CVE-2026-55255 is a cross-tenant Insecure Direct Object Reference (IDOR) vulnerability in the /api/v1/responses endpoint, carrying a CVSS score of 9.9. The vector is CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L — network-accessible, low-complexity exploitation with low privileges required, high confidentiality and integrity impact, and changed scope across tenant boundaries. The root cause is located in the get_flow_by_id_or_endpoint_name function, which queries the Flow table by primary key without verifying that the flow.user_id matches the authenticated user. An attacker can enumerate flow UUIDs via GET /api/v1/flows/ and replay those IDs as the model parameter on POST /api/v1/responses to execute flows belonging to other users. Crucially, CVE-2026-55255 is inert on its own; it requires the flow enumeration bug — specifically the /api/v1/flows/ oversharing issue — to be reachable.
In a blog post published June 26, 2026, the Sysdig Threat Research Team (TRT) documented exploitation observed on June 25. The attacker timeline, originating from a single IP address (45.207.216.55), began with application and authentication reconnaissance on June 22, followed by an auto_login event on June 25. The attacker then performed flow enumeration via /api/v1/flows/, executed the IDOR twice with the prompt injection “leak api keys” — designed to coerce flows with embedded credentials into surfacing secrets — and established a sustained RCE loop. According to Clark, the two attacks served different purposes:
The RCE went after the host, while the IDOR went after other tenants’ flows and their keys.
This is the second time Langflow has appeared in the KEV catalog. The first, CVE-2026-33017, was an unauthenticated RCE vulnerability with a CVSS score of 9.3, added on March 25, 2026. Approximately 7,000 servers are currently under attack via that vulnerability. Sysdig TRT observed the same operator chaining both CVEs in credential-harvesting campaigns. The RCE enrolled the host as a botnet; the IDOR skimmed credentials. Clark wrote:
The operator poured sustained effort into the lower-scored RCE and treated the higher-scored IDOR as a two-request afterthought, only adding it to their toolset to cover more exploitation possibilities.
While the IDOR carries a higher CVSS score, it is technically harder to exploit than the RCE because it requires authentication and flow ID enumeration. The RCE is unauthenticated and internet-sprayable. However, the IDOR provides a specific edge in multi-tenant environments by crossing tenant boundaries at the application layer — where the RCE would be sandboxed per tenant. Clark wrote:
A 9.9 that requires authorization, a disclosed object ID, and a multi-tenant target loses in practice to a 9.3 that is unauthenticated and internet sprayable.
Langflow flows embed LLM provider keys (OpenAI/Anthropic), cloud credentials, and database secrets directly in their component configs, which are high-value, liquid, and immediately abusable via resale or LLM model abuse.
A fix for the IDOR was merged on April 22, 2026, in Langflow 1.9.1 via PR #12832. The patch modifies the get_flow_by_id_or_endpoint_name function to verify that the flow’s user_id matches the requester’s, and returns a 404 error instead of a 403 to prevent attackers from confirming the existence of specific flows. The vulnerability is documented in GitHub Security Advisory GHSA-qrpv-q767-xqq2. The patch has been available for months. Federal agencies must update to 1.9.1+ by end of day July 10.