On 7 July 2026, the US Cybersecurity and Infrastructure Security Agency added a Langflow vulnerability, tracked as CVE-2026-55255, to its Known Exploited Vulnerabilities (KEV) catalog, alongside other actively-exploited flaws flagged that week, and ordered federal civilian agencies to remediate it by 10 July under Binding Operational Directive 26-04, the directive that in June replaced the prior uniform-deadline BOD 22-01 with risk-based timelines. The Langflow entry is the notable one: it is the fourth Langflow vulnerability CISA has placed in the KEV catalog since May 2025, after CVE-2025-3248, CVE-2026-33017 and CVE-2025-34291. Langflow is a widely used open-source visual framework for building AI agents — a drag-and-drop interface for wiring components into executable pipelines, with an API to run them — and its repeated appearance on the list is a marker for a category of software that is moving quickly into production without always carrying production-grade security assumptions. The fix is available: the flaw is patched in Langflow 1.9.1, and the current guidance is to run 1.9.2 or later.
What the flaw is
Described at the level that helps defenders without helping attackers, CVE-2026-55255 is a cross-tenant authorisation-bypass flaw — an insecure direct object reference, in the standard terminology. An authenticated user can reference another user's workflows and, through them, reach the sensitive material those workflows hold. That material is the point: AI-agent flows routinely store the credentials the agent needs to do its job, including API keys for large-language-model providers and cloud services. The cloud-security firm Sysdig, which documented the in-the-wild activity, described the objective plainly as credential theft across tenants, with the stolen keys opening the door to whatever downstream services they unlock.
In the observed campaign, this authorisation flaw was chained with an earlier Langflow remote-code-execution vulnerability (CVE-2026-33017, patched in March) so that one part of the attack went after the host and the other went after other tenants' credentials. Sysdig reported first observing exploitation of this flaw on 25 June, following a wave of remote-code-execution activity on 22 June, before any public proof-of-concept existed and before the KEV listing, and assessed the activity as opportunistic and financially motivated. This article deliberately does not reproduce the vulnerable endpoint, the request technique, the chaining steps or the attacker infrastructure; the operationally useful facts are the class of flaw, its impact and the fix.
Why AI-agent frameworks are a credential trove
The single most useful thing to take from this incident is why it keeps happening to this kind of software. AI-agent frameworks concentrate two things that are individually valuable to an attacker and dangerous together: high-value credentials and system-level execution. The credentials are the API keys to model providers and cloud accounts that the agent needs in order to act; the execution is the framework's core purpose, running code and calling tools with the host process's permissions. A platform that holds both is a target in a way a simple web application is not, because a single compromise can yield both the keys and a foothold. As Sysdig put it in describing this campaign, the code-execution flaw went after the host while the authorisation flaw went after other tenants' keys.
The recurrence bears this out. CVE-2026-55255 is the fourth Langflow flaw on CISA's KEV catalog since May 2025. Earlier Langflow vulnerabilities have been put to notable use: according to reporting on the listing, Sysdig found that a ransomware operation it calls JadePuffer used one of them, CVE-2025-3248, to dump Langflow's PostgreSQL database, and Sysdig described the operator behind the latest campaign as pursuing both a compromised host's compute, for botnet implants, and its credentials. None of this makes Langflow uniquely careless — it is a legitimate and heavily deployed tool — but it does make the category a proven and repeatable target.
CVSS is not the whole story
This vulnerability is also a clean illustration of a prioritisation point worth internalising. Its severity score has been reported inconsistently, which is instructive rather than confusing: a numerical CVSS rating measures the worst-case potential severity of a flaw, not the likelihood that anyone will actually exploit it. The two diverge often. The earlier no-authentication Langflow RCE was exploited within about twenty hours of disclosure precisely because it required no account and produced immediate code execution, while this authorisation flaw requires an existing login and some enumeration first. Attackers optimise for ease, not for CVSS numbers. The practical implication is to prioritise with more than one signal: a place on the KEV catalog means exploitation is confirmed, an elevated EPSS score means exploitation is statistically likely, and a high CVSS on its own means neither. The KEV listing here is the signal that matters.
What to do
Patch now. Update Langflow to 1.9.2 or later. Federal civilian agencies are bound to do so by 10 July; every other organisation running Langflow should treat it with the same urgency.
Rotate credentials if you were exposed. If a Langflow instance was reachable from the internet, rotate every credential stored in it — model-provider API keys and cloud access keys included — and treat this as mandatory rather than precautionary, because a cross-tenant authorisation abuse can leave little that stands out in ordinary logs.
Take agent frameworks off the open internet. Do not expose Langflow, or any agent-orchestration platform, to the public internet without authentication in front of it.
Audit and monitor. Review access logs for anomalous cross-user activity and watch for unexpected outbound connections from hosts running AI pipelines, following CISA's and the vendor's guidance.
Update, 18 October 2026: CISA has since added two more Langflow flaws to the catalog — CVE-2026-0770 on 21 July and CVE-2026-9198 on 4 August — according to its KEV data feed.
Key Takeaways
CISA added CVE-2026-55255, an actively-exploited Langflow vulnerability, to its KEV catalog on 7 July 2026, with a 10 July remediation deadline for US federal civilian agencies under BOD 26-04. It is the fourth Langflow flaw on the catalog since May 2025. The flaw is patched in Langflow 1.9.1; update to 1.9.2 or later.
The vulnerability is a cross-tenant authorisation bypass (an insecure direct object reference) that lets an authenticated user reach other users' workflows and the credentials stored in them — API keys for model providers and cloud services. Sysdig observed opportunistic, financially motivated exploitation in late June, aimed at cross-tenant credential theft and chained with an earlier Langflow RCE.
AI-agent frameworks are repeat targets because they concentrate high-value credentials and system-level execution in one place: CVE-2026-55255 is the fourth Langflow flaw on the KEV catalog since May 2025, and an earlier one, CVE-2025-3248, was used in a ransomware operation that dumped the platform's database. Langflow is a legitimate, widely used tool; the category, not the product, is the lesson.
Act on it: patch to 1.9.2+ now, rotate all stored API and cloud keys if the instance was internet-exposed (treat as mandatory), keep agent frameworks off the open internet without authentication, and audit access logs. Prioritise using the KEV catalog and EPSS alongside CVSS, since a high CVSS alone does not indicate exploitation.
Correction, 18 October 2026: An earlier version, including its headline, said Langflow was the first AI-agent platform on CISA's Known Exploited Vulnerabilities catalog. That was wrong: CISA had listed three earlier Langflow flaws, the first in May 2025. We have also removed an unsourced count of seven exploited Langflow flaws, corrected the account of earlier attacks, which had counted one ransomware case twice, and corrected the exploitation dates Sysdig reported.
View author profile → · Editorial policy
