HIGHCVSS 8.4KNOWN EXPLOITED

CVE-2026-55255

CVE-2026-55255 updated by NVD

Published: 2026-07-07
Modified: 2026-11-04
Sources: cisa-kev, nvd

Summary

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55255

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.