Langflow Product Security Update Advisory (CVE-2026-55255)

Overview

A security update has been released to address a vulnerability in the Langflow product. This vulnerability is identified as CVE-2026-55255.

Affected Versions

• Langflow versions prior to 1.9.1.

Vulnerability Details

• An insecure direct object reference (IDOR) vulnerability—where an authenticated user can access objects they are not authorized to access—was identified in the Langflow endpoint.
• According to the title of the reference site, an authenticated threat actor can access other users’ Flows via the /api/v1/responses endpoint.

Mitigation

• A Vulnerability Patch has been provided via the latest update.
• Langflow users should update to the latest version with the Vulnerability Patch, following the instructions on the reference site.

Notes

• CVE-2026-55255.
• Langflow version 1.9.1 Or later has been confirmed to resolve this vulnerability.