HIGHCVSS 8.4Actively exploited · CISA KEV since 2026-07-07Vulnerability
CVE-2026-55255
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
Properties
- Vulnerability name
- Langflow Authorization Bypass Through User-Controlled Key Vulnerability
- Epss score
- 0.00887
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2026-07-10
- Exploited euvd since
- 2026-07-07T00:00:00+00:00
- Date added
- 2026-07-07
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Ghsa updated
- 2026-06-19T21:16:47Z
- Score
- 8.4
- Euvd base score version
- 3.1
- Euvd vendor
- langflow-ai
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 8.4
- Is ghsa only
- false
- Vendor project
- Langflow
- Content hash
- 6bbf423623642cb7785f48ca06c9ec323a796ba91f5b88eaeeee3e74779fdef6
- Published at
- 2026-06-23T17:17:08.050
- Euvd updated
- 2026-10-07T18:13:46+00:00
- Last modified
- 2026-10-07T19:17:38.593
- Euvd epss pct
- 0.89
Related Entities (7)
AFFECTS (1)
AFFECTS_PRODUCT (1)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
MENTIONED_IN (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph