CISA tells federal agencies to fix actively exploited Langflow IDOR flaw by Friday

The U.S. Cybersecurity and Infrastructure Security Agency directed federal agencies to apply a fix for an actively exploited vulnerability in the Langflow visual framework by the end of this week.

CISA adds the Langflow authorization bypass to its Known Exploited Vulnerabilities catalog. The agency placed CVE-2026-55255 into the KEV catalog on Tuesday. Federal Civilian Executive Branch agencies must secure their devices by Friday under Binding Operational Directive 26-04.

CISA warned that "this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise." Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

The IDOR flaw enables authenticated attackers to access other users' flows and sensitive data. Tracked as CVE-2026-55255, this Insecure Direct Object Reference vulnerability lets threat actors reach other users' flows through specially crafted requests sent to the /api/v1/responses endpoint that include the victim's UUID (flow_id). Successful exploitation also enables attackers to access sensitive data processed by the victim's flows and consume their resources.

Langflow serves as a popular visual framework for building AI agents. It provides a drag-and-drop interface for linking nodes into executable pipelines along with a REST API that supports programmatic execution, making the platform an attractive target for hackers within the AI development ecosystem.

Sysdig researchers observed in-the-wild exploitation aimed at code execution and implant delivery. Sysdig's Threat Research Team first observed the exploitation on June 25, noting that the objective was "code execution and second-stage implant delivery (loader/dropper class." The researchers described the threat actor as opportunistic and financially motivated, stating that "the motive was money via the two reliable yields of a compromised AI host: its compute (botnet/implant) and its credentials (LLM/cloud keys), both of which were pursued with cheap, repeatable, low-sophistication tooling."

CISA has previously added multiple Langflow vulnerabilities to the KEV catalog. The agency added a Langflow missing authentication security issue tracked as CVE-2025-3248 in May 2025. It added a code injection vulnerability tracked as CVE-2026-33017 in March 2026. CISA flagged the CVE-2025-3248 issue as exploited by ransomware gangs on Tuesday after Sysdig reported that the JadePuffer ransomware operation used it to dump Langflow's PostgreSQL database. Since June, attackers have also been actively exploiting a high-severity Langflow path traversal vulnerability tracked as CVE-2026-5027 to write arbitrary files on exposed servers, according to VulnCheck security researcher Caitlin Condon.