CVE-2026-55255

HIGH CISA KEV

ACT NOW Priority: 0.07 BB Relevance: 57/100

Published: 2026-06-23 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction Conf. Impact Integ. Impact Scope Change

CVSS Vector Breakdown

AV: Network

AC: High

PR: Low

UI: None

S: Changed

C: High

I: High

A: Low

Description

Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

CISA Known Exploited Vulnerability

Vendor / Product Langflow — Langflow

Date Added 2026-07-07

Remediation Due 2026-07-10

https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55255