This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. CISA added it on July 7, 2026.

CriticalVulnerability

GHSA-qrpv-q767-xqq2: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-55255GHSA-qrpv-q767-xqq2
Published: June 19, 2026
Record updated: October 20, 2026

View JSON

Affected: langflow < 1.9.1
Fixed in: 1.9.1
released April 23, 2026, 56 days before disclosure
Known exploitation: Listed in the CISA Known Exploited Vulnerabilities catalog since July 7, 2026.
EPSS: 0.9%

Summary

GHSA-qrpv-q767-xqq2 is an insecure direct object reference (IDOR) in Langflow's `/api/v1/responses` endpoint. The helper `get_flow_by_id_or_endpoint_name` in `src/backend/base/langflow/helpers/flow.py` looks up flows by UUID without checking ownership, so any authenticated user can execute another user's flow by supplying its flow ID. The source says attackers can run any flow, access data its processing handles, and consume the victim's resources.

Mitigation

Fixed in PR #12832 (`fix(security): close IDOR in get_flow_by_id_or_endpoint_name`), merged 2026-04-22 and released in Langflow 1.9.1. The helper now enforces ownership on both the UUID and endpoint_name lookup branches, returns 404 for cross-user lookups, and fails closed on a malformed user_id.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.9%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.
Known exploitation: Listed in CISA KEV, exploited in the wild
Disclosure date: June 19, 2026

Affected

Packages: langflow@< 1.9.1 (fixed: 1.9.1)

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: API
Impact: Confidentiality,
Integrity,
Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-qrpv-q767-xqq2

First tracked: June 19, 2026 at 08:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

langflowPyPIReaches an LLM package through dependencies

Coverage

News, research and other items that mention CVE-2026-55255.

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsThe Hacker News · 2026-10-15
GenAI and Agentic AI Exploit Roundup Q2 2026OWASP GenAI Security · 2026-07-09

Summary

Mitigation

Affected packages in the Exposure Registry

Coverage

Related items