{
 "id": "AIR-2026-0026",
 "slug": "langflow-idor-vulnerability-allows-unauthorized-flow-executi",
 "title": "Langflow IDOR Vulnerability Allows Unauthorized Flow Execution",
 "summary": "Langflow prior to version 1.9.1 contains an Insecure Direct Object Reference vulnerability in its API responses endpoint. Attackers can execute arbitrary flows belonging to other users, with exploitation confirmed in the wild.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 3,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Langflow"
 ],
 "incident_date": "2026-06-23",
 "incident_date_precision": "day",
 "first_reported": "2026-06-19",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-qrpv-q767-xqq2",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-55255: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow",
   "published_at": "2026-06-19"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55255",
   "publisher": "NVD",
   "title": "CVE-2026-55255: Langflow is a tool for building and deploying AI-powered agents and workflows.",
   "published_at": "2026-06-23"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-55255",
  "langflow",
  "idor",
  "cisa-kev"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}