Langflow CVE-2026-55255: an auth bypass on AI agent workflows, now in the CISA KEV

> In short: CVE-2026-55255 is an IDOR (Insecure Direct Object Reference) flaw (CVSS 9.8) in Langflow, the open-source visual framework for building AI agents. An authenticated attacker can access other users' flows by sending a crafted request to /api/v1/responses with the victim's UUID. Actively exploited since June 25, 2026. CISA added it to its KEV catalog on July 7 with a one-week remediation deadline.

Why this matters to you

Langflow has become a default building block for teams shipping AI features: a drag-and-drop interface to wire LLMs, tools, and data sources into executable pipelines, plus a REST API to run them. If your product added an "AI assistant", a RAG chatbot, or an agent feature in the last 18 months, there's a real chance Langflow (or a similar framework) sits under it.

That makes AI orchestration layers a new high-value target — and CVE-2026-55255 is a textbook example of why.

The flaw in two sentences

It's an IDOR. The /api/v1/responses endpoint takes a flow identifier (flow_id, a UUID) and runs the corresponding flow — but it doesn't check that the caller owns or is authorized to access that flow. Send a request with someone else's UUID and you get their flow's data, the sensitive content it processes, and you consume their resources.

An IDOR is the most common authorization flaw in APIs — OWASP API1:2023 (BOLA). It is not an AI-specific bug. What makes it acute here is *what* Langflow flows contain: prompts, retrieved documents, connected data sources, model credentials, and often the LLM API keys the flow runs against.

What the attackers actually wanted

Sysdig's Threat Research Team, who observed the exploitation from June 25, was clear about motive: "code execution and second-stage implant delivery (loader/dropper class)." Their read: the attacker is opportunistic and financially motivated, and the two reliable yields of a compromised AI host are compute (the box joins a botnet or runs an implant) and credentials (LLM and cloud keys). Cheap, repeatable, low-sophistication tooling.

That matches the broader pattern: exposed AI infrastructure is being harvested for the value of the API keys it holds. A single leaked OpenAI or Anthropic key is worth real money on resale markets, and a Langflow instance is a concentrated stash of them.

This is not Langflow's first rodeo

Langflow has now had four CISA-flagged flaws in roughly a year:

The pattern tells you something: AI orchestration frameworks are being targeted continuously, and they ship fast on features and slower on security. If you embed one, treat it as internet-exposed infrastructure that needs its own patching SLA, network isolation, and credential hygiene.

What to do

For an AI-feature team, the lesson is that the AI surface inherits every classic web vulnerability — IDOR, auth bypass, path traversal, RCE — and then adds new ones on top. The framework being "AI" does not change the basics; it makes them more expensive when they fire.