Insecure Direct Object Reference in Langflow Tool by Langflow AI
CVE-2026-55255

9.9CRITICAL

Key Information:

Vendor

Langflow-ai

Status
Langflow
Vendor
CVE Published:
23 June 2026

What is CVE-2026-55255?

The Langflow tool, designed for developing and managing AI-driven agents and workflows, suffers from an Insecure Direct Object Reference (IDOR) vulnerability in its /api/v1/responses endpoint. This flaw allows authenticated attackers to gain unauthorized access to another user's workflows by manipulating the flow ID in their requests, compromising the integrity and security of user data. The issue has been addressed in version 1.9.2, emphasizing the need for users to update promptly to safeguard their applications.

Affected Version(s)

langflow < 1.9.2

References

https://github.com/langflow-ai/langflow/security/advisori...
x_refsource_CONFIRM
https://github.com/langflow-ai/langflow/pull/12832
x_refsource_MISC

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.