CISA orders feds to prioritize patching Langflow auth bypass flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch an actively exploited vulnerability in Langflow, a popular tool for building AI agents with a drag-and-drop interface. The flaw, tracked as CVE-2026-55255, is an IDOR (insecure direct object reference, where an attacker can access data they shouldn't by manipulating request parameters) that lets authenticated attackers view other users' workflows and steal sensitive data or computing resources. Attackers are already using this vulnerability to gain code execution and deploy malware to compromise servers and steal credentials.