The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch an actively exploited authorization bypass vulnerability in Langflow, the popular visual framework for building AI agents, giving them until Friday to comply. CISA added the flaw, tracked as CVE-2026-55255, to its Known Exploited Vulnerabilities (KEV) Catalog on Tuesday.
Langflow's popularity in the AI development ecosystem makes exposed instances a valuable target, and researchers have already observed in-the-wild exploitation aimed at code execution, implant delivery, and stealing cloud and LLM credentials.
Key takeaways
- CISA added CVE-2026-55255 to its KEV catalog and set a Friday patching deadline for federal civilian agencies under BOD 26-04.
- The flaw is an Insecure Direct Object Reference (IDOR) that lets authenticated attackers access other users' flows via the /api/v1/responses endpoint.
- Sysdig's Threat Research Team first observed in-the-wild exploitation on June 25, tied to code execution and second-stage implant delivery.
- Researchers describe the attackers as opportunistic and financially motivated, targeting host compute and stored credentials.
- This is the third Langflow flaw CISA has flagged as exploited, following CVE-2025-3248 and CVE-2026-33017.
Affected
What happened
CISA gave U.S. Federal Civilian Executive Branch (FCEB) agencies until Friday to patch an actively exploited vulnerability in Langflow, a visual framework used to build AI agents. The agency added the flaw to its Known Exploited Vulnerabilities Catalog on Tuesday, triggering remediation requirements under Binding Operational Directive (BOD) 26-04.
Langflow is a popular tool in the AI development ecosystem, offering a drag-and-drop interface to connect nodes into executable pipelines and a REST API to run them programmatically. That popularity, combined with internet-exposed instances, makes it an attractive target for attackers.
Federal deadline
FCEB agencies must remediate CVE-2026-55255 by Friday under BOD 26-04. CISA advises stakeholders to evaluate each asset's internet exposure.
- Tracked as CVE-2026-55255
- Added to CISA KEV on Tuesday
How the flaw works
CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) vulnerability. It allows authenticated threat actors to access other users' flows by sending a maliciously crafted request to the /api/v1/responses endpoint containing the victim's UUID (flow_id).
Successful exploitation also lets attackers reach sensitive data processed by the victim's flows and consume the victim's resources — a meaningful risk given that AI pipelines frequently handle credentials, API keys, and proprietary data.
- Vulnerable endpoint: /api/v1/responses
- Requires authentication; abuses victim flow_id (UUID)
How it is being exploited
Sysdig's Threat Research Team (TRT) first observed CVE-2026-55255 exploitation in the wild on June 25. According to the researchers, the objective was code execution and second-stage implant delivery of a loader or dropper class.
Sysdig characterized the activity as opportunistic and financially motivated, describing attackers pursuing the two reliable payoffs of a compromised AI host — its compute for botnet or implant use, and its stored credentials such as LLM and cloud keys — using cheap, repeatable, low-sophistication tooling.
- First in-the-wild exploitation observed June 25
- Goals: compute abuse and credential theft
A pattern of Langflow flaws
CVE-2026-55255 is the third Langflow issue CISA has flagged as exploited. In May 2025, the agency added a missing authentication flaw (CVE-2025-3248) to its KEV catalog, and in March 2026 it added a code injection vulnerability (CVE-2026-33017).
On Tuesday, CISA also flagged the earlier missing-authentication flaw as exploited by ransomware, after Sysdig reported that the JadePuffer ransomware operation used it to dump Langflow's PostgreSQL database. Separately, VulnCheck researcher Caitlin Condon reported that attackers have been actively exploiting a high-severity Langflow path traversal vulnerability (CVE-2026-5027) since June to write arbitrary files on exposed servers.
- CVE-2025-3248 linked to JadePuffer ransomware
- CVE-2026-5027 path traversal exploited since June
What administrators should do
- Update Langflow to a version that addresses CVE-2026-55255.
- Evaluate whether Langflow instances are exposed to the internet and reduce exposure where possible.
- Review authentication and access controls on Langflow deployments.
- Rotate any credentials, LLM keys, or cloud keys accessible from Langflow hosts if compromise is suspected.
- FCEB agencies must remediate by the CISA-set Friday deadline under BOD 26-04.
Timeline
Impact & actions
Authenticated attackers can access other users' Langflow flows and the sensitive data they process, with observed exploitation leading to code execution, implant delivery, and credential theft.
Security: Attackers can steal LLM and cloud credentials and hijack host compute for botnet or implant use.
Privacy: Sensitive data processed by victim flows may be exposed to unauthorized users.
Recommended actions · High urgency
- 1Patch Langflow to a fixed version
- 2Reduce internet exposure of Langflow instances
- 3Rotate credentials and cloud/LLM keys if compromise is suspected
Technical details
- CVEs
- CVE-2026-55255, CVE-2025-3248, CVE-2026-33017, CVE-2026-5027
- Exploitation
- Exploited in the wild
- Attack vector
- Authenticated request to the /api/v1/responses endpoint using the victim's flow_id (UUID)
Mitigations
- Update Langflow to a version that fixes CVE-2026-55255
- Reduce or eliminate internet exposure of Langflow instances
- Restrict and review authentication and access controls
Response
Authorities
Customer guidance
Patch affected Langflow instances and evaluate internet exposure; FCEB agencies must remediate by the Friday deadline.
FAQ
What is CVE-2026-55255?
It is an Insecure Direct Object Reference (IDOR) authorization bypass in Langflow that lets authenticated attackers access other users' flows by sending a crafted request to the /api/v1/responses endpoint with the victim's flow_id.
When must federal agencies patch it?
CISA added the flaw to its KEV catalog on Tuesday and ordered FCEB agencies to remediate by Friday, as required by BOD 26-04.
Is the flaw being actively exploited?
Yes. Sysdig's Threat Research Team first observed in-the-wild exploitation on June 25, tied to code execution and second-stage implant delivery.
What do attackers do after exploiting it?
Researchers observed financially motivated attackers pursuing host compute for botnet or implant use and stored credentials such as LLM and cloud keys.
The bottom line
CISA added the actively exploited Langflow IDOR flaw CVE-2026-55255 to its KEV catalog, ordering federal civilian agencies to patch by Friday under BOD 26-04.
What happens next
What to do
