highclosedpatched

Langflow Langflow: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

› Langflow Langflow

last updated Jul 7, 2026

Get an email when a new major security incident drops. No spam, unsubscribe any time.

started: Jul 7, 2026
closed: Jul 7, 2026
CVEs: 1
sources: 3

## summary

Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. Added to CISA KEV on 2026-07-07.

severity: Actively exploited (CISA KEV)

## cve ids[1]

CVE-2026-55255

## affected

See vendor advisory / CISA notes (versions not always listed in KEV feed)

## fixed in

See vendor advisory linked in sources

## timeline[1]

Jul 7, 2026
CISA added CVE-2026-55255 to the KEV catalog (due 2026-07-10).

## advisories[3]

## notes & caveats

Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).

Get notified