Langflow IDOR executes flows as others (CVE-2026-55255)

Actively exploited in the wild - CVE-2026-55255 is a high-severity Insecure Direct Object Reference (IDOR) in Langflow 1.9.0 and earlier that lets any authenticated attacker execute arbitrary AI flows belonging to other users. Patched in Langflow 1.9.1 — update immediately.

Overview

CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) vulnerability in the /api/v1/responses endpoint of Langflow, an open-source tool for building and deploying AI-powered agents and workflows. An authenticated attacker can exploit this flaw by simply supplying a victim’s flow ID in a request, causing Langflow to execute that flow as if the attacker were the authorized owner.

The vulnerability affects all Langflow versions prior to 1.9.1. It has a CVSS score of 8.4 (HIGH), with a network attack vector, high attack complexity, low privileges required, and no user interaction needed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation in the wild, and it appears on the Known Exploited Vulnerabilities (KEV) catalog. Despite a low EPSS score of 0.2%, the confirmed exploitation warrants immediate attention.

Impact

An attacker with valid user credentials can enumerate or guess flow IDs belonging to other users and force Langflow to execute those workflows. This could lead to:

• Unauthorized execution of AI agents, potentially consuming compute resources or triggering actions in connected systems.
• Exposure of sensitive data processed by the victim’s flows.
• Disruption of legitimate workflows or manipulation of AI agent outputs.

Because Langflow workflows often integrate with external services (databases, APIs, cloud platforms), the blast radius extends beyond the application itself.

Remediation

Immediate action: Update to Langflow version 1.9.1 or later, which contains the fix. The patch adds authorization checks to the /api/v1/responses endpoint, ensuring only the flow owner can trigger execution.

Mitigation (if immediate patching is not possible):

• Restrict network access to the Langflow API to trusted IP ranges only.
• Monitor API logs for anomalous /api/v1/responses requests using suspicious flow IDs.
• Implement additional authentication layers (e.g., API tokens with per-flow scoping) if your deployment allows.

For full details, refer to the Langflow security advisory. Related breach analyses are available at breach reports.

Security Insight

This IDOR in a low-code AI platform mirrors a pattern seen in other automation tools like Apache Airflow and Prefect, where object-level authorization gaps are often overlooked in rapid development cycles. What makes CVE-2026-55255 particularly concerning is its confirmed exploitation in the wild despite a low EPSS score, suggesting attackers are specifically targeting AI workflow orchestration tools before broad automated scanning begins. For organizations adopting Langflow, this incident underscores the critical need to treat every API endpoint as a potential cross-user boundary, especially in platforms where flows can execute external commands or access sensitive data.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs