Langflow is a tool for building and deploying AI-powered agents and workflows

Langflow's /api/v1/responses endpoint takes a client-supplied flow_id (UUID) and executes the flow. The vulnerable code path in get_flow_by_id_or_endpoint_name (helpers/flow.py) queries the database on UUID alone — no user_id ownership check. Any authenticated caller can therefore invoke any other user's flow by guessing/leaking the UUID. Affected versions: all Langflow < 1.9.2 (the fix in PR #12832 initially shipped in 1.9.1, but the definitive vendor-recommended fixed release is 1.9.2). The endpoint_name resolution branch is *not* vulnerable — only the UUID branch skips the ACL.

Vendor rating is HIGH (8.4) using CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L. Reality is worse than the label. AC:H assumes UUID guessing is hard, but flows persist secrets — OpenAI/Anthropic keys, AWS/GCP credentials, DB passwords — so a single successful invocation cascades into cross-tenant secret theft. Sysdig TRT observed active exploitation starting 2026-06-25, and CISA added it to KEV on 2026-07-07 with a Friday remediation deadline. On a KEV-listed, actively-exploited auth-bypass in an AI orchestration platform that holds every credential the org uses to talk to LLMs and clouds, HIGH understates it.

Why this verdict

• KEV + active exploitation — CISA added this on 2026-07-07 after Sysdig documented in-the-wild credential harvesting. KEV alone forces mitigation-within-hours regardless of the bucket.
• Role multiplier — Langflow is a secret-holding orchestration plane. Flows routinely embed OpenAI/Anthropic/Bedrock API keys, cloud IAM tokens, DB creds, and vector-store secrets. A single successful cross-user execute is effectively a credential vault dump for that tenant. Blast radius: tenant → cloud accounts → LLM billing → downstream data stores. This puts the verdict floor at CRITICAL for canonical AI-platform deployments.
• AC:H is misleading. The high complexity rating reflects UUID guessing, but UUIDs leak via other Langflow APIs, shared links, exports, and git. Once a UUID is known, exploitation is a single HTTP call.
• PR:L barrier is soft — any authenticated user counts, and shared/multi-tenant Langflow instances (SaaS, internal dev sandboxes) are exactly the deploy pattern where cross-user attack is the point of the platform.
• Fix is available and cheap (upgrade to 1.9.2), so there is no legitimate business reason to leave this un-remediated past KEV's window.

Why not higher?

There is no higher bucket than CRITICAL. Score is 9.3 rather than 10.0 because the attacker still needs (a) an authenticated foothold and (b) knowledge of a victim UUID — a completely unauthenticated pre-auth RCE would score higher.

Why not lower?

Downgrading to HIGH would ignore the KEV listing and observed exploitation. Downgrading to MEDIUM would ignore that the affected component is a credential-holding orchestration plane and that fix is a trivial version bump. Neither is defensible with Sysdig's telemetry on the table.

1. Upgrade to Langflow 1.9.2 immediately — This is the vendor fix and the only durable control. Per noisgate CRITICAL SLA and KEV override, deploy within hours to 3 days, not weeks. Test in staging same-day, roll to prod within 72h.
2. Restrict Langflow to authenticated users behind SSO + VPN/ZTNA — Remove internet exposure of the /api/v1 surface. Front Langflow with an identity-aware proxy so PR:L is not satisfied by self-signup. Deploy within 3 days.
3. Rotate every secret referenced in any Langflow flow — Assume breach: rotate OpenAI/Anthropic/Bedrock keys, cloud IAM credentials, and DB passwords stored in flows. If exploitation window overlaps 2026-06-25 → patch date, treat exposed secrets as compromised. Complete within 3 days.
4. Move secrets out of flow definitions into a vault reference — Even post-patch, embedded secrets are a systemic risk. Use Langflow's variable/global-variable mechanism backed by an external secret store (Vault, AWS Secrets Manager) so the next IDOR-class bug doesn't turn into another credential dump.
5. Audit /api/v1/responses logs for owner-mismatch invocations — Cross-reference the flow_id in access logs against the flow's owner. Any hit where invoker ≠ owner between 2026-06-23 and patch date is an incident. Complete within 3 days.

Run this from an auditor workstation or CI runner that can reach the Langflow instance over HTTPS. Invoke as ./check_langflow.sh https://langflow.example.internal — no privileges required, uses the unauthenticated /health and version endpoints. Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

#!/usr/bin/env bash
# noisgate: CVE-2026-55255 Langflow IDOR version check
# Usage: ./check_langflow.sh <base_url>
# Example: ./check_langflow.sh https://langflow.corp.example.com
set -u

BASE_URL="${1:-}"
if [[ -z "$BASE_URL" ]]; then
  echo "Usage: $0 <langflow_base_url>" >&2
  exit 2
fi

FIXED_MAJOR=1
FIXED_MINOR=9
FIXED_PATCH=2

# Langflow exposes version via /api/v1/version or /health
VER_JSON=$(curl -sk --max-time 10 "${BASE_URL%/}/api/v1/version" || true)
if [[ -z "$VER_JSON" ]]; then
  VER_JSON=$(curl -sk --max-time 10 "${BASE_URL%/}/health" || true)
fi

if [[ -z "$VER_JSON" ]]; then
  echo "UNKNOWN: could not reach $BASE_URL" >&2
  exit 2
fi

VER=$(echo "$VER_JSON" | grep -oE '"version"[[:space:]]*:[[:space:]]*"[0-9]+\.[0-9]+\.[0-9]+' | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: version string not found in response" >&2
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<<"$VER"

if (( MAJ > FIXED_MAJOR )) || \
   (( MAJ == FIXED_MAJOR && MIN > FIXED_MINOR )) || \
   (( MAJ == FIXED_MAJOR && MIN == FIXED_MINOR && PAT >= FIXED_PATCH )); then
  echo "PATCHED: Langflow $VER >= 1.9.2"
  exit 0
else
  echo "VULNERABLE: Langflow $VER < 1.9.2 (CVE-2026-55255)"
  exit 1
fi

Sources

1. GitHub Advisory GHSA-qrpv-q767-xqq2
2. Sysdig: Understanding Langflow CVE-2026-55255
3. Help Net Security: credential harvesting via CVE-2026-55255
4. BleepingComputer: CISA orders feds to prioritize patching
5. SentinelOne vulnerability database entry
6. Endor Labs advisory
7. Tenable CVE page
8. GitLab Advisories mirror