2026-07-07 · 2026-Q3
CISA Adds Langflow IDOR (CVE-2026-55255) to KEV, First AI Agent Platform in the Catalog
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
Langflow before 1.9.1 (guidance updated to 1.9.2)
Impact
An insecure direct object reference in `/api/v1/responses` lets an authenticated attacker execute any flow belonging to another user by supplying the victim's flow ID, exposing embedded LLM provider keys, cloud credentials, and database secrets. Sysdig observed a lone operator chaining reconnaissance, this IDOR, and a loop of the Langflow RCE CVE-2026-33017 between June 22 and 25, 2026 to harvest secrets and stage second-stage implants. CISA added it to the Known Exploited Vulnerabilities catalog on July 7 with a July 10 federal deadline, the first AI agent orchestration platform to enter the catalog
Root cause
Authorization bypass through a user-controlled key (CWE-639); flow lookups query by UUID with no ownership check
CVEs
Sources
Catalog
Cite this: AgentProv incident record: CISA Adds Langflow IDOR (CVE-2026-55255) to KEV, First AI Agent Platform in the Catalog (2026-07-07). https://agentprov.com/incidents/2026-07-07-cisa-adds-langflow-idor-cve-2026-55255-to-kev-first-ai-agent-platform-in-the
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run