Threat Intelligence / CVE / CVE-2026-55255

CVE-2026-55255

CVSS 9.9 (CRITICAL) · EPSS 0.2% · Priority 5.5/10 · Published 2026-06-23

As of 2026-06-24, CVE-2026-55255 is a CVSS 9.9 (CRITICAL-severity) vulnerability. EPSS exploitation probability 0.2%. Threadlinqs Intelligence tracks 0 threats exploiting it.

Last updated: 2026-06-24

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. This vulnerability is fixed in 1.9.2.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-639

Affected packages

pip:langflow — patched in 1.9.1

References

Full detection coverage & IOCs for threats exploiting CVE-2026-55255 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.