CVE-2026-55255High· 8.4▾ Abyssal⚠ Exploited in the wildPoC availableLangflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow be…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 46.2 · likelihood 0.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Jul 10, 2026
29%
1 GitHub repo
Last analysed / modified upstream
9.9 → 8.4
critical → high
Added to the CISA catalog on Jul 7, 2026. Federal remediation due Jul 10, 2026. View catalog ↗
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.1.
langflow < 1.9.1Upgrade past the affected range:
langflow 1.9.1Affected packages:
langflow < 1.9.1Patched in:
langflow 1.9.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105698Medium· 5.4Langflow is a tool for building and deploying AI-powered agents and workflows
CVE-2026-105699High· 7.1Langflow is a tool for building and deploying AI-powered agents and workflows
CVE-2025-3248Critical· 9.8Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint
CVE-2025-34291High· 8.8Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution
CVE-2026-0770HighLangflow affected by Remote Code Execution via validate_code() exec()
CVE-2026-93678High· 7.6IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.