Langflow lets users run other users' private workflows

Published July 7, 2026 CVE-2026-55255

Langflow builds AI chatbots and automated workflows. A logged-in user who knows another workflow's identifier can run it without the owner's permission.

Severity
HighCVSS 3.1 · 8.4
Fix
Fixed in 1.9.1Fix recorded on Aug 26, 2026
Affected versions
before 1.9.1
Weakness
CWE-639Authorization Bypass Through User-Controlled Key
Exploit likelihood
0.89% in 30 daysEPSS, higher than 57% of known flaws
Affects
Langflow
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Jul 7, 2026
Federal fix deadline
Jul 10, 2026

How it works

  • Langflow looks up a workflow by its identifier but fails to check whether the signed-in user owns it.
  • The lookup can therefore return another user's workflow to a function that runs it.
  • The attacker needs an account and the workflow identifier.

What to do

Check the version in the Python environment that runs Langflow with python3 -m pip show langflow, or ask the service administrator for that version. Compare it with the affected range above. An affected installation is exposed to the flaw, but that alone does not show someone accessed another user's workflow.

Run this in the application environment you want to check:

python3 -m pip show langflow

Update Langflow to 1.9.1 or a later supported release using your deployment's normal update process. Restart or redeploy it as required and confirm the running version. The project identifies 1.9.1 as the release containing the ownership check.

Technical details

CVE-2026-55255 is an authorization failure when Langflow retrieves a workflow by its identifier. The project advisory GHSA-qrpv-q767-xqq2 identifies the missing ownership check and the fixed release. Italy's CSIRT reported active exploitation on July 8, 2026.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L Open in FIRST.org calculator

References

View Original Source