CVE-2026-55255: Critical IDOR in Langflow Exposes AI Flow Data via /api/v1/responses

Vulnerability Overview

CVE-2026-55255 is a critical Insecure Direct Object Reference (IDOR) vulnerability in Langflow, classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The root cause is a failure to enforce ownership checks on the /api/v1/responses API endpoint — the application trusts a caller-supplied object identifier without verifying that the authenticated user owns the referenced flow. This enables horizontal privilege escalation: any authenticated user can enumerate and read another user's flow data simply by manipulating the object ID in their request.

With a CVSS score of 9.9, the impact is severe. Exposed data may include sensitive AI flow configurations, credentials or API keys embedded directly in flow nodes, and proprietary automation logic — any of which can be leveraged for further compromise or intellectual property theft.

Affected Software

The vulnerability affects Langflow (distributed via pip) in all versions prior to 1.9.1. Organizations running self-hosted or cloud-deployed Langflow instances below this version are exposed. At time of publication, no patched release date has been confirmed — defenders should treat all pre-1.9.1 deployments as actively vulnerable.

Exploitation Status

A public proof-of-concept (PoC) is available, disclosed on 19 June 2026. The exploit is low-complexity: an attacker needs only a valid authenticated session and knowledge of (or ability to enumerate) a target flow's object identifier. Sequential or UUID-space enumeration against /api/v1/responses is a realistic attack path. The combination of a public PoC, critical CVSS score, and zero authentication barrier beyond a basic account makes exploitation highly accessible. Defenders should prioritise detection and remediation immediately.

How Our Detection Catches It

The df00tech detection pack ships coverage across seven SIEM platforms for CVE-2026-55255:

• Microsoft Sentinel (KQL) — identifies anomalous cross-user flow access patterns by correlating authenticated principals against response object ownership metadata in API gateway or application logs.
• Splunk (SPL) — detects enumeration behaviour via statistical analysis of request volumes and object ID spread per user session against the /api/v1/responses path.
• Elastic (EQL) — sequences authentication events with rapid successive hits to the vulnerable endpoint, flagging probable IDOR probing.
• IBM QRadar (AQL) — rule-based detection on HTTP 200 responses to /api/v1/responses where the requesting user differs from the flow owner, where ownership metadata is available in logs.
• Sumo Logic — log search rules targeting outlier request rates per authenticated identity against the affected endpoint.
• Google Chronicle (YARAL) — event matching on Langflow API access logs for cross-user object access indicators.
• CrowdStrike (CQL) — Falcon LogScale query detecting IDOR enumeration signatures in HTTP access telemetry.

All queries are tuned to minimise false positives in multi-tenant Langflow deployments while surfacing genuine horizontal traversal attempts. The detection logic focuses on the intersection of authenticated identity, endpoint path, and object ownership divergence — the core signal for this class of vulnerability.

Remediation

Upgrade Langflow to version 1.9.1 or later as soon as a patched release is available. In the interim, restrict access to the /api/v1/responses endpoint at the network or reverse-proxy layer to trusted IP ranges, enforce rate limiting to slow enumeration, and audit existing flow data for embedded credentials that may have been exposed.

For full KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARAL, and CrowdStrike CQL queries — along with playbook guidance and atomic test cases — see the CVE-2026-55255 detection page.