Langflow flaw CVE-2026-55255 used to run other users’ AI workflows; fixed in 1.9.1
Attackers are exploiting a Langflow flaw that lets a signed-in user run someone else’s AI workflows, potentially exposing sensitive data and consuming resources. Organisations running Langflow should update to 1.9.1 or later and investigate unauthorised use.
If you or your workplace runs Langflow, update it to version 1.9.1 or later, or ask the administrator to do so. Ask them to investigate unexpected workflow runs and possible exposure of information handled by those workflows.
What’s happening
Langflow, software for building AI agents and automated workflows, failed to check ownership when a signed-in user accessed another user’s workflow by its identifier. CVE-2026-55255 affects versions before 1.9.1 and can expose sensitive information processed by those workflows or consume the owner’s computing resources. Langflow merged a correction on 22 April and released it in version 1.9.1 on 24 April, before publishing its advisory on 19 June. CISA confirmed exploitation by adding the flaw to its catalogue on 7 July. As at 3 November, Langflow lists 1.9.1 and later as patched and rates the flaw critical, with a CVSS score of 9.9. CISA still lists it as exploited; whether it has been used in ransomware campaigns is unknown.
- What
- Flaw
- Affects
- Langflow AI workflow platform
- Affected
- Langflow versions before 1.9.1
- Fixed in
- Langflow 1.9.1 and later
- Since
- 7 July 2026
- Closed
- 7 July 2026
Timeline
- CISA added
CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 10 July remediation deadline for US federal civilian agencies.
- Made public
Langflow published its advisory for CVE-2026-55255. It identifies versions before 1.9.1 as affected.
- New fixFixed
Langflow released version 1.9.1, including the fix that prevents users from running other users’ workflows.
- UpdatePartly fixed
Langflow merged the ownership-check fix. A merged change alone did not provide a released update.
Sources
- IDOR Vulnerability in /api/v1/responses Endpoint Allows Authenticated Attackers to Access Another User's FlowLangflow · 19 June 2026
- Langflow 1.9.1 releaseLangflow · 24 Apr 2026
- Known Exploited Vulnerabilities catalogue — 3 November 2026 editionCISA · 3 Nov 2026
- Langflow security advisory (AV26-670)Canadian Centre for Cyber Security · 8 July 2026
- CISA Warns About Langflow Authorization Bypass Vulnerability Exploitation (CVE-2026-55255)Qualys · 10 July 2026