[KEV] CVE-2026-55255 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-55255 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-55255 is an authorization bypass vulnerability in Langflow that allows an authenticated attacker to execute flows belonging to other users by manipulating a user-controlled key in the request.

Technical Detail

The flaw exists because Langflow fails to enforce proper ownership validation when processing flow execution requests. An authenticated attacker can substitute a victim's flow ID in the request parameter, causing the application to execute that flow under the attacker's session without verifying that the requesting user has authorization to access it. The practical impact is unauthorized execution of arbitrary flows owned by any other user on the platform, which may expose sensitive data, trigger unintended automation, or allow lateral movement within multi-tenant Langflow deployments.

Exploitation Status

CISA has confirmed active exploitation in the wild, with this vulnerability added to the Known Exploited Vulnerabilities catalog on July 7, 2026. The exploit maturity is rated Operational, meaning functional exploit code exists and is being used in real-world attacks, not merely demonstrated in a controlled research context.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability in the available intelligence data.

What To Do

Under CISA's Binding Operational Directive 22-01, federal agencies are required to remediate this vulnerability promptly given its KEV listing on July 7, 2026. Organizations should apply the latest available Langflow patch immediately and prioritize this remediation given confirmed active exploitation. As an interim measure, restrict Langflow access to trusted, authenticated users only and audit flow execution logs for anomalous cross-user activity, specifically requests where the authenticated user's identity does not match the owner of the referenced flow ID. If patching cannot be completed immediately, consider disabling public or shared flow execution endpoints until the fix is applied.