PT-2026-51099 · Langflow · Langflow

Published 2026-06-19 · Updated 2026-06-20 · CVE-2026-55255

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions langflow versions prior to 1.9.1

Description An Insecure Direct Object Reference (IDOR) exists in the '/api/v1/responses' endpoint. This issue allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. The flaw is located in the get flow by id or endpoint name() helper function, which queries the database for flows by UUID without verifying if the authenticated user owns the requested flow. This can lead to the exposure of sensitive data processed by the victim's flows and the unauthorized consumption of their resources.

Recommendations Upgrade to version 1.9.1.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-55255

GHSA-QRPV-Q767-XQQ2

Affected Products

Langflow

References · 6

• https://osv.dev/vulnerability/GHSA-qrpv-q767-xqq2 · Vendor Advisory
• https://github.com/langflow-ai/langflow/pull/12832 · Note
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2 · Note
• https://github.com/langflow-ai/langflow · Note
• https://twitter.com/AretiqAI/status/2068096863111090663 · Twitter Post
• https://twitter.com/UpwindMDR/status/2068308829561815198 · Twitter Post