Langflow authorization bypass allows attackers to execute user flows and harvest credentials

Summary

Security researchers have observed active exploitation of an Insecure Direct Object Reference (IDOR) vulnerability in Langflow, a visual framework used for building AI agents and RAG pipelines. The flaw allows authenticated attackers to hijack the execution of any user's flow by providing its unique ID to a specific API endpoint.

The exploitation involves targeting sensitive data processed within these flows, such as LLM provider keys, cloud credentials, and database secrets. While the vulnerability is being used alongside other high-severity flaws, it offers a specific method for crossing tenant boundaries in multi-tenant or managed environments.

Technical details

The vulnerability exists within the get_flow_by_id_or_endpoint_name function located in helpers/flow.py. When a user attempts to resolve a flow using its UUID, the application performs a database lookup without verifying if the requesting user owns that specific flow.

While the endpoint_name resolution path enforces ownership checks, the UUID-based path does not. This allows an attacker to bypass authorization by targeting the /api/v1/responses endpoint. To succeed, an attacker must first obtain a valid, random 122-bit flow UUID, which researchers observed being harvested via the /api/v1/flows/ endpoint.

Exploitation status

CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, with a required remediation deadline of July 10, 2026.

The Sysdig Threat Research Team observed an operator using this IDOR vulnerability in conjunction with a remote code execution (RCE) flaw. In these observed attacks, the actor used the IDOR to inject prompts like "leak api keys" into hijacked flows, aiming to extract embedded credentials from the victim's environment. This activity occurs alongside broader exploitation of Langflow where attackers attempt to deploy second-stage implants for botnet or credential-harvesting purposes.

Affected products and fixed versions

The vulnerability affects Langflow instances where the IDOR flaw has not been patched.

Why this matters for defenders

For organizations running managed or multi-tenant AI orchestration platforms, this flaw represents a significant risk of cross-tenant data exposure. Even if an attacker's code execution is confined to a specific sandbox, the IDOR allows them to trigger legitimate execution paths using a victim's high-privilege credentials and context.

The attack pattern observed involves a two-step process: first, enumerating available flows to harvest UUIDs, and second, replaying those IDs against the responses endpoint to extract secrets. This makes the presence of an exposed /api/v1/flows/ endpoint a critical reconnaissance indicator.

Defender guidance

• Update Immediately: Upgrade Langflow to version 1.9.1 or higher to resolve the authorization bypass in helpers/flow.py.
• Audit API Exposure: Evaluate the internet exposure of your Langflow instances. Ensure that internal API endpoints used for flow management are not accessible to unauthenticated or unauthorized external actors.
• Monitor API Traffic: Watch for unusual activity on the /api/v1/responses endpoint, specifically requests containing UUIDs that do not belong to the authenticated user.
• Credential Rotation: If you suspect a Langflow instance has been accessed by an unauthorized party, rotate all LLM provider keys (OpenAI, Anthropic), cloud credentials, and database secrets stored within your AI agent configurations.

#h4rithd #news #HarithDilshan #Langflow #Cybersecurity #AI #Vulnerability