CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
Overview
Langflow, an AI workflow and agent-building platform, contains an Insecure Direct Object Reference (IDOR) flaw in its /api/v1/responses endpoint that allows any authenticated user to execute flows belonging to other users. By supplying a victim's flow UUID in a standard API request, an attacker can trigger arbitrary workflow logic, access data the flow processes, and consume the victim's resources. All versions before 1.9.1 are affected.
Vulnerability details
The flaw lives in the get_flow_by_id_or_endpoint_name helper function in src/backend/base/langflow/helpers/flow.py. When a caller supplies a UUID to identify a flow, the function retrieves that flow from the database using only the UUID as the lookup key, with no check that the authenticated user owns the returned record. The endpoint_name lookup path did enforce ownership, but the UUID path did not, creating an inconsistent authorization boundary. This is a textbook CWE-639 pattern: the attacker controls the object key, and the server trusts it without verifying the caller's relationship to the object.
An attacker with a valid Langflow account and API key sends a POST request to /api/v1/responses, placing the victim's flow UUID in the model field and their own API key in the x-api-key header. The server authenticates the request, retrieves the victim's flow by UUID without an ownership check, and executes it, returning HTTP 200. The attacker gains the ability to run any flow in the system whose UUID they know, potentially reading sensitive data the flow processes, triggering AI agent logic they do not own, and consuming the victim's compute resources. Knowing or enumerating a target flow UUID is a prerequisite.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor API access logs for POST requests to
/api/v1/responseswhere the authenticated user's identity does not match the owner of the flow UUID supplied in themodelfield. Before the fix, these cross-user calls returned HTTP 200; after patching, they return 404. - Alert on a single API key issuing POST requests to
/api/v1/responseswith multiple distinct flow UUIDs in rapid succession, which may indicate UUID enumeration or systematic cross-user flow execution. - Audit application logs for 500-series errors on
/api/v1/responsestied to malformeduser_idvalues, which in pre-1.9.1 versions could indicate probing of the authorization boundary.
Remediation
Additional hardening
- Upgrade Langflow to version 1.9.1 or later, which enforces ownership checks on both UUID and endpoint_name lookup paths in
get_flow_by_id_or_endpoint_nameand returns 404 for cross-user lookups. - Restrict network access to the Langflow API to trusted users and internal networks only. Internet-exposed instances significantly widen the pool of authenticated attackers who can reach
/api/v1/responses. - Apply the principle of least privilege to Langflow API key issuance: limit which users can create API keys and rotate or revoke keys for accounts that do not require programmatic access to the responses endpoint.
- Review Langflow audit logs for historical cross-user flow executions against
/api/v1/responsesto determine whether the vulnerability was exploited before patching, paying particular attention to flows that process sensitive data.
Key dates
References
- https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e
- https://github.com/langflow-ai/langflow/pull/12832
- https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-55255
- https://webflow.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255
Frequently asked questions
Does CVE-2026-55255 affect my FedRAMP authorization?
If Langflow runs inside your authorization boundary, CVE-2026-55255 is a direct concern for your FedRAMP authorization. CISA has listed this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of July 10, 2026. An unpatched KEV inside your boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it as a deficiency.
How does Knox help me handle CVE-2026-55255?
Knox does not patch your software. Remediating Langflow is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to carry out that remediation, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours; maintaining a compliant posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including cases like CVE-2026-55255. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal deficiency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-55255 isn't remediated by July 10, 2026?
Missing the July 10, 2026 deadline turns CVE-2026-55255 into a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what converts a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Remediating by the deadline keeps your authorization intact and the agency relationship straightforward.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
