Threat · curated 8 Jul 2026
Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited
First reported · updated · 2 reports sysdig.com
Coverage timeline
Why it matters
Langflow is a popular AI-agent building platform, and attackers are actively chaining this IDOR with flow-listing disclosure and a separate RCE to harvest LLM/cloud credentials and deploy implants on AI hosts, making it a live threat to organizations running AI development pipelines.
CISA added CVE-2026-55255, an actively exploited Insecure Direct Object Reference (IDOR) authorization-bypass flaw in the Langflow visual framework for building AI agents, to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch it. The flaw lets authenticated attackers access other users' flows via the /api/v1/responses endpoint using a victim's flow UUID, and Sysdig observed in-the-wild exploitation aimed at leaking API keys, delivering second-stage loaders, and stealing LLM/cloud credentials and compute.
Summary
CVE-2026-55255 is an Insecure Direct Object Reference (IDOR) authorization-bypass vulnerability in Langflow, a popular visual framework for building AI agents. It allows an authenticated attacker to access other users' flows by sending a maliciously crafted request to the /api/v1/responses endpoint containing a victim's flow UUID (flow_id), exposing sensitive data processed by those flows and consuming their resources.[0]
Sysdig's Threat Research Team first observed in-the-wild exploitation on June 25, 2026, assessing the actor as opportunistic and financially motivated, pursuing code execution and second-stage implant delivery (loader/dropper class). CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 7, 2026, ordering federal civilian agencies to remediate by Friday under BOD 26-04.[0][7]
A central theme of the reporting is that CVSS score is not an exploitation rank: the 9.9-scored IDOR requires authorization, a disclosed object ID, and a multi-tenant target, and in practice loses to a lower-scored but unauthenticated, internet-sprayable RCE (CVE-2026-33017). The IDOR is inert on its own and only becomes reachable because the /api/v1/flows/ listing overshares victim flow UUIDs.[5]
Observed exploitation chained the IDOR with the code-injection RCE CVE-2026-33017 to gain execution and deliver a loader/dropper, with the attacker seeking a compromised AI host's compute (botnet/implant) and its credentials (LLM/cloud keys) using cheap, repeatable, low-sophistication tooling.[0][5]
Attack chain
- Reconnaissance and probing: The actor issued liveness checks (GET /health) and probed the no-auth default via GET /api/v1/auto_login, followed by enumeration probes against user and API-key endpoints (POST/GET /api/v1/users/, POST /api/v1/api_key/).[5]
- Object ID disclosure: The attacker enumerated flows via GET /api/v1/flows/ — the oversharing disclosure step that reveals victim flow UUIDs required for the IDOR to function.[5]
- IDOR exploitation (CVE-2026-55255): Using disclosed flow UUIDs, the actor sent crafted POST requests to /api/v1/responses with a payload input of 'leak api keys' to access other users' flows and their sensitive data and credentials.[0][5]
- Remote code execution (CVE-2026-33017): The actor ran approximately four RCE waves, each proceeding auto_login → /api/v1/flows/ → RCE via POST /api/v1/build_public_tmp/ /flow, attempting outbound connections to 45.207.216.55:8084.[5]
- Second-stage implant delivery: RCE shelled out to curl/wget piped to sh to fetch a second-stage loader from hxxp://45.207.216.55:8084/slt, writing the execution marker /tmp/lang_pwn, aiming at code execution and loader/dropper-class implant delivery.[0][5]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-06-25 | Sysdig TRT first observed in-the-wild exploitation of CVE-2026-55255; the session included health checks, auto_login probing, user/api_key enumeration, flow enumeration, IDOR POST /api/v1/responses payloads, and later CVE-2026-33017 RCE waves with outbound attempts to 45.207.216.55:8084.[0][5] |
| 2026-07-07 | CISA added CVE-2026-55255 (authorization bypass) to its Known Exploited Vulnerabilities Catalog, ordering FCEB agencies to remediate by Friday per BOD 26-04.[0][7] |
| 2025-05 (context) | CISA previously added Langflow missing-authentication flaw CVE-2025-3248 to the KEV catalog in May 2025; it was flagged on Tuesday as exploited by ransomware gangs, after Sysdig reported the JadePuffer ransomware operation used it to dump Langflow's PostgreSQL database.[0] |
| 2026-03 (context) | CISA added Langflow code-injection vulnerability CVE-2026-33017 to the KEV catalog in March 2026.[0] |
How it works
CVE-2026-55255 is an Insecure Direct Object Reference: an authenticated request to /api/v1/responses supplying another user's flow UUID (flow_id) returns that victim's flow, allowing cross-user access to sensitive data and resource consumption. Sysdig demonstrates the IDOR is inert on its own — it requires a way to obtain a victim's flow UUID, which the oversharing /api/v1/flows/ listing supplies, making the disclosure endpoint part of the IDOR's real attack surface.[0][5]
In observed exploitation the IDOR was paired with code-injection RCE CVE-2026-33017 reached via POST /api/v1/build_public_tmp/ /flow, where the RCE shelled out to curl/wget piped to sh to fetch a second-stage loader. Sysdig contrasts the 9.9-scored IDOR — which needs authorization, a disclosed object ID, and a multi-tenant target — against the lower-scored but unauthenticated, internet-sprayable RCE, noting the RCE is the practical patching priority except in managed/multi-tenant deployments where the RCE is sandboxed per tenant and the cross-tenant IDOR becomes the only quiet path to another customer's data.[5]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Langflow (visual framework for building AI agents) | Deployments exposing the /api/v1/responses endpoint vulnerable to CVE-2026-55255; managed/multi-tenant deployments are most impacted by the IDOR, while internet-exposed instances are also affected by chained CVE-2026-33017 and CVE-2026-5027. | CISA-mandated remediation for FCEB agencies by Friday under BOD 26-04 following the July 7, 2026 KEV listing.[0][7] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 45.207.216.55 | Single source IP and C2 for the observed exploitation; hosts the second-stage loader at hxxp://45.207.216.55:8084/slt and receives outbound RCE attempts on port 8084.[5] |
| other | JA4 TLS fingerprint t13i1f0a00_e8f1e7e78f70_1f22a2ca17c4 | Constant TLS fingerprint across the attack session, usable as a detection indicator.[5] |
| file-path | /tmp/lang_pwn | Execution marker written by the injected loader, indicating successful RCE and implant execution.[5] |
| cve | CVE-2026-55255 | Langflow IDOR/authorization bypass at /api/v1/responses; scored 9.9 but inert without object-ID disclosure and most impactful in multi-tenant deployments.[0][5] |
| cve | CVE-2026-33017 | Langflow unauthenticated code-injection RCE chained after the IDOR via POST /api/v1/build_public_tmp/ /flow; the practically preferred path reachable with only network access.[0][5] |
| cve | CVE-2026-5027 | Separate high-severity Langflow path traversal flaw exploited since June to write arbitrary files on exposed servers.[0] |
| cve | CVE-2025-3248 | Earlier KEV-listed Langflow missing-authentication flaw reportedly used by the JadePuffer ransomware operation to dump the PostgreSQL database.[0] |
Key takeaways
- CVSS score is not an exploitation rank: a 9.9 IDOR that requires authorization, a disclosed object ID, and a multi-tenant target is often less urgent in practice than a lower-scored, unauthenticated, internet-sprayable RCE — but the IDOR deserves full urgency in managed/multi-tenant Langflow where it is the only quiet cross-tenant path.[5]
Defensive actions
- Patch CVE-2026-55255 and prioritize per BOD 26-04 deadlines: CISA added the flaw to KEV and required FCEB remediation, noting this vulnerability class is a frequent attack vector posing significant federal-enterprise risk.[0][7]
- Prioritize patching the unauthenticated RCE CVE-2026-33017: Sysdig notes the lower-scored RCE is the practical priority because attackers reach it with nothing but network access, making it more exploitable than the higher-scored IDOR.[5]
- Treat object-ID disclosure endpoints (e.g., /api/v1/flows/) as part of the IDOR attack surface: CVE-2026-55255 is inert without a way to obtain victim flow UUIDs; the oversharing flow listing is what makes it exploitable.[5]
- Give the IDOR full urgency in managed/multi-tenant Langflow deployments: In multi-tenant settings the RCE is sandboxed per tenant, so the application-layer cross-tenant IDOR is the only quiet path to another customer's flows and credentials.[5]
- Deploy runtime detections and hunt for the published IOCs: Indicators including source IP 45.207.216.55, the loader endpoint, the JA4 fingerprint, and the /tmp/lang_pwn marker enable detection as advisory-to-exploit timelines compress.[5]