{"id":"langflow-cross-user-flow-attacks-jul-2026","category":"patch","status":"closed","title":"Langflow flaw CVE-2026-55255 used to run other users’ AI workflows; fixed in 1.9.1","tldr":"Attackers are exploiting a Langflow flaw that lets a signed-in user run someone else’s AI workflows, potentially exposing sensitive data and consuming resources. Organisations running Langflow should update to 1.9.1 or later and investigate unauthorised use.","summary":"Langflow, software for building AI agents and automated workflows, failed to check ownership when a signed-in user accessed another user’s workflow by its identifier. CVE-2026-55255 affects versions before 1.9.1 and can expose sensitive information processed by those workflows or consume the owner’s computing resources. Langflow merged a correction on 22 April and released it in version 1.9.1 on 24 April, before publishing its advisory on 19 June. CISA confirmed exploitation by adding the flaw to its catalogue on 7 July. As at 3 November, Langflow lists 1.9.1 and later as patched and rates the flaw critical, with a CVSS score of 9.9. CISA still lists it as exploited; whether it has been used in ransomware campaigns is unknown.","action":"If you or your workplace runs Langflow, update it to version 1.9.1 or later, or ask the administrator to do so. Ask them to investigate unexpected workflow runs and possible exposure of information handled by those workflows.","product":"Langflow AI workflow platform","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-55255"],"tags":["langflow","ai","authorisation-bypass","actively-exploited"],"affected":["Langflow versions before 1.9.1"],"fixed":["Langflow 1.9.1 and later"],"matches":[],"sources":[{"kind":"advisory","title":"IDOR Vulnerability in /api/v1/responses Endpoint Allows Authenticated Attackers to Access Another User's Flow","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","by":"Langflow","date":"2026-06-19"},{"kind":"post","title":"Langflow 1.9.1 release","url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.1","by":"Langflow","date":"2026-04-24"},{"kind":"advisory","title":"Known Exploited Vulnerabilities catalogue — 3 November 2026 edition","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","date":"2026-11-03"},{"kind":"advisory","title":"Langflow security advisory (AV26-670)","url":"https://www.cyber.gc.ca/en/alerts-advisories/langflow-security-advisory-av26-670","by":"Canadian Centre for Cyber Security","date":"2026-07-08"},{"kind":"research","title":"CISA Warns About Langflow Authorization Bypass Vulnerability Exploitation (CVE-2026-55255)","url":"https://threatprotect.qualys.com/2026/07/10/cisa-warns-about-langflow-authorization-bypass-vulnerability-exploitation-cve-2026-55255/","by":"Qualys","date":"2026-07-10"}],"started":"2026-07-07","closed":"2026-07-07","created":"2026-11-03T22:17:45.712Z","updated":"2026-11-03T22:17:45.712Z","cve_notes":[{"cve":"CVE-2026-55255","name":"Missing workflow ownership check in Langflow","what":"A missing ownership check in Langflow’s responses API lets an authenticated attacker run another user’s AI workflow, potentially exposing sensitive data and consuming that user’s resources.","severity":"critical","cvss":9.9}],"timeline":[{"at":"2026-07-07","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 10 July remediation deadline for US federal civilian agencies.","url":"https://raw.githubusercontent.com/cisagov/kev-data/main/known_exploited_vulnerabilities.json","by":"CISA","patch":null},{"at":"2026-06-19","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Langflow published its advisory for CVE-2026-55255. It identifies versions before 1.9.1 as affected.","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","by":"Langflow","patch":null},{"at":"2026-04-24","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Langflow released version 1.9.1, including the fix that prevents users from running other users’ workflows.","url":"https://github.com/langflow-ai/langflow/releases/tag/v1.9.1","by":"Langflow","patch":"patched"},{"at":"2026-04-22","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Langflow merged the ownership-check fix. A merged change alone did not provide a released update.","url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2","by":"Langflow","patch":"partial"}],"url":"https://hard.fyi/live/langflow-cross-user-flow-attacks-jul-2026/","json":"https://hard.fyi/api/live?id=langflow-cross-user-flow-attacks-jul-2026"}