[KEV] CVE-2026-55255 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-55255 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-55255 is an authorization bypass vulnerability in Langflow, the open-source AI workflow builder, that allows an authenticated attacker to execute flows owned by other users by manipulating a user-controlled key in the request.

Technical Detail

The flaw exists because Langflow does not enforce ownership validation when a flow execution request is submitted. An authenticated attacker can substitute a victim's flow ID in the request parameter, causing the application to execute that flow under the attacker's session without verifying authorization. The practical impact is unauthorized execution of arbitrary flows belonging to other users, which may expose sensitive data, trigger unintended automation, or allow lateral movement within a shared Langflow environment depending on what those flows contain.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on July 7, 2026. The exploit maturity is rated Operational, meaning a reliable, functional exploit exists and is being used in real-world attacks rather than existing only as a proof of concept. Organizations running Langflow should treat this as an actively targeted vulnerability requiring immediate action.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this CVE based on currently available data.

What To Do

Per CISA's Known Exploited Vulnerabilities binding directive (BOD 22-01), federal agencies are required to patch or apply mitigations by the deadline associated with the July 7, 2026 KEV listing. All organizations running Langflow should apply the vendor-supplied patch immediately. If a patch is not yet available or cannot be applied immediately, restrict access to Langflow instances to trusted, authenticated users only and consider placing the application behind a network access control layer to limit exposure. Monitor application logs for anomalous flow execution requests, particularly those referencing flow IDs not associated with the authenticated user's account. Review audit logs for any historical flow execution activity that may indicate prior exploitation.