CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability

Langflow contains an authorization bypass through user-controlled key vulnerability. An authenticated attacker can execute any flow that belongs to another user by supplying that user's flow identifier in requests to the application. This issue affects organizations running Langflow and can result in unauthorized execution of workflows and access to associated data or logic.

How it works

The weakness is categorized as CWE-639. An authenticated user supplies a flow identifier that belongs to another account. The application does not enforce ownership checks on that identifier, allowing the attacker to invoke the target flow.

Attackers abuse this by crafting requests that reference arbitrary flow IDs. No further details on exploitation mechanics are provided in the available information.

Am I affected? How to find it in your systems

Inventory all Langflow installations in your environment, including any self-hosted or cloud deployments. Review the vendor advisory to determine which versions or configurations require attention.

• Examine application logs for requests that reference flow identifiers not associated with the authenticated session.
• Check access-control and flow-management configurations for reliance on client-supplied identifiers without server-side ownership validation.
• Correlate authentication events with subsequent flow-execution activity that crosses user boundaries.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. Confirm the exact patch or configuration change against the vendor documentation for your deployment.

• Enforce server-side authorization checks that validate flow ownership before execution.
• Review and tighten API or request-handling paths that accept user-controlled identifiers for sensitive operations.
• Apply least-privilege principles to all accounts that interact with flows.

If you can't patch immediately

Follow CISA guidance on applying mitigations per vendor instructions and BOD 26-04 requirements. Segment Langflow instances from other systems and limit network exposure.

• Monitor for anomalous flow-execution requests that reference identifiers outside the expected user scope.
• Disable or restrict the affected flow-execution endpoints if business requirements allow.
• Consider virtual patching or request-filtering controls that block cross-user flow ID references until a patch can be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to breaches. You can run a free exposure scan of your email addresses to check known breach data.