CVE-2026-55255: Langflow Flow-Ownership IDOR Remediation

Langflow versions before 1.9.1 resolve a flow by UUID in get_flow_by_id_or_endpoint_name without checking that the authenticated caller owns that flow. The /api/v1/responses path (and related workflow lookups that share the helper) can then execute another user's flow when the caller supplies that flow's identifier. GHSA-qrpv-q767-xqq2 is high (CVSS 8.4) and names langflow < 1.9.1 -> 1.9.1. NVD CPE excludes 1.9.1. This catalog record stores high. Do not invent a Critical 9.9 GHAD score.

The vendor fix landed in PR #12832 and is released in Langflow 1.9.1. Cross-user lookups now fail closed with 404 rather than a 403 that would confirm the flow exists. CISA added CVE-2026-55255 to the Known Exploited Vulnerabilities catalog on 2026-07-07 (required action due 2026-07-10).

This floor is not the last word for a Langflow fleet. CVE-2026-9198 requires Langflow OSS 1.10.1+. OSV/PYSEC-2026-221 records the fixed event as 1.9.2 and still lists 1.9.1; if a scanner flags 1.9.1, take 1.9.2 or the later KEV floor. Do not prove exposure by executing another user's flow or submitting a victim flow identifier.

When to use it

• A repository deploys, builds, pins, vendors, or documents Langflow before 1.9.1.
• Langflow is a multi-user, shared, or network-exposed workbench where more than one principal can obtain an API key or session.
• You already applied CVE-2025-3248 (1.3.0+) and still need the ownership check on flow lookup.
• You need a bounded PR that upgrades Langflow, proves cross-user flow lookup is denied, and documents later KEV floors.

Inputs

• Python dependency files, lockfiles, Dockerfiles, compose/Helm/K8s/Terraform manifests, gateway/proxy config, environment templates, SBOMs, and runbooks.
• Langflow version evidence, multi-user vs single-user deployment, API-key and session ownership, /api/v1/responses and /api/v1/run* route ownership, ingress exposure, logs, and credential rotation owners.
• Available dependency install, authorization tests, container build, deployment render, SBOM, and dependency/security scan commands.

Affected versions

• Vulnerable: GHAD langflow < 1.9.1. NVD CPE excludes 1.9.1.
• Fixed: GHAD/NVD first_patched 1.9.1.
• Conservative scanner floor: 1.9.2+ when OSV/PYSEC-2026-221 still lists 1.9.1 as affected.
• Fleet floor after later KEVs: Langflow OSS 1.10.1+ for CVE-2026-9198.
• Affected helper: get_flow_by_id_or_endpoint_name UUID lookup used by /api/v1/responses and related workflow routes.
• Weakness: CWE-639 authorization bypass through a user-controlled key (IDOR).
• CISA KEV: yes; added 2026-07-07 with required action due 2026-07-10.

Indicator-of-exposure

• The repository deploys, builds, vendors, pins, or documents Langflow <1.9.1.
• More than one user, service account, or API key can reach the same Langflow API.
• /api/v1/responses or /api/v1/run* is reachable on a shared workbench, ingress, tunnel, or hosted notebook.
• Flow identifiers are visible in URLs, logs, analytics, or shared docs.

Quick checks:

rg -n "langflow|LANGFLOW|/api/v1/responses|get_flow_by_id_or_endpoint_name" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Windows:

rg -n "langflow|LANGFLOW|/api/v1/responses|get_flow_by_id_or_endpoint_name" .
python -m pip show langflow
python -m pip freeze | rg -i "^langflow=="
docker images | rg -i "langflow"

Do not call /api/v1/responses with another user's flow identifier, execute a victim flow, or dump flow secrets.

Remediation strategy

• Upgrade every controlled Langflow dependency, lockfile, image, Helm chart, compose service, deployment manifest, SBOM, and runbook to at least langflow 1.9.1+. Prefer 1.9.2+ if scanners still flag 1.9.1, and 1.10.1+ when CVE-2026-9198 is also in scope.
• Until rollout is complete, restrict Langflow API access to a single trusted principal or deny /api/v1/responses and /api/v1/run* at the gateway for shared deployments.
• Confirm patched builds enforce owner-scoped flow lookup and return 404 for cross-user UUID access.
• Review flow-execution logs for unexpected /api/v1/responses activity. Rotate Langflow, model provider, database, package, cloud, and workflow credentials when another principal could have executed a flow.

The prompt

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-55255, a Langflow insecure direct object
reference in flow lookup used by `/api/v1/responses`. Produce exactly
one output:

- A reviewer-ready PR/change request that upgrades Langflow to 1.9.1+
  (1.9.2+ if scanners still flag 1.9.1; 1.10.1+ when CVE-2026-9198 is
  also in scope), adds safe ownership regression coverage, and documents
  operator cleanup, or
- TRIAGE.md if this repository does not own an affected Langflow runtime.

## Rules

- Scope only CVE-2026-55255 and directly related Langflow flow-lookup,
  ownership, ingress, isolation, and credential cleanup.
- A prior upgrade to 1.3.0 for CVE-2025-3248 is not a complete fix.
- Treat flows, component code, tokens, provider keys, and logs as sensitive.
- Do not prove exposure by submitting another user's flow identifier,
  executing a victim flow, or dumping environment variables.
- Do not auto-merge.

## Steps

1. Inventory every Langflow runtime this repository controls.
2. A target is vulnerable if it resolves to Langflow before `1.9.1`.
3. If Langflow is not owned here, stop with `TRIAGE.md` listing files
   checked, owner if known, observed version, and required `1.9.1+`.
4. Upgrade every controlled Langflow package and image to `1.9.1+`.
   Use `1.9.2+` when OSV still lists `1.9.1`. Use `1.10.1+` when
   CVE-2026-9198 is also required. Regenerate lockfiles, image digests,
   SBOMs, and docs as usual.
5. Restrict shared API access until every runtime is patched.
6. Add safe tests:
   - dependency policy rejects `langflow < 1.9.1`;
   - an authenticated caller cannot resolve another user's flow by UUID;
   - unauthorized lookup returns 404 without disclosing flow existence;
   - tests never execute another user's flow or log bearer tokens.
7. Add a PR body section named `CVE-2026-55255 operator actions` that
   states versions before and after, whether `/api/v1/responses` was
   reachable by more than one principal, whether later Langflow KEVs
   raise the floor, which credentials to rotate, and any temporary
   edge block.
8. Use PR title:
   `fix(sec): remediate CVE-2026-55255 in Langflow`.

## Stop conditions

- No affected Langflow runtime is controlled by this repository.
- A fixed Langflow version cannot be consumed and shared API access
  cannot be restricted.
- Meaningful verification would require executing another user's flow
  or exposing secrets.
- Validation fails for unrelated pre-existing reasons; document those
  failures instead of broadening scope.

Rollback

Do not restore Langflow before 1.9.1 to a reachable multi-user deployment. If the patched build must be withdrawn, keep /api/v1/responses and /api/v1/run* denied for untrusted principals or stop the shared service until another fixed release is installed.

Verification

• No controlled dependency, image, SBOM, or runbook resolves Langflow <1.9.1.
• Cross-user flow lookup by UUID is denied with 404 and does not execute the target flow.
• Gateway or network containment is present when rollout is not atomic.
• Tests never submit a victim flow identifier or execute another user's flow.
• Operator notes cover GHSA-qrpv-q767-xqq2, the OSV 1.9.2 discrepancy, KEV dates, later Langflow KEV floors, log review, and credential rotation.

Output contract

• Reviewer-ready PR upgrading Langflow to 1.9.1+ (or the higher scanner/KEV floor in scope) and restricting shared API access during rollout.
• TRIAGE.md when Langflow ownership is outside this repository.

Watch for

• Stopping at Langflow 1.3.0 after CVE-2025-3248 and leaving 1.3.x– 1.9.0 in production.
• Treating GHSA 1.9.1 as the fleet floor while CVE-2026-9198 still requires 1.10.1.
• Testing with another user's flow identifier or live provider keys.
• Updating one requirements file while an image or Helm chart still runs <1.9.1.

Related recipes

• CVE-2025-3248 Langflow validate/code
• CVE-2026-9198 Langflow auto-login RCE
• Search the CVE Database for CVE-2026-55255
• CVE intelligence intake gate

References

• Langflow advisory: https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2
• Fix PR: https://github.com/langflow-ai/langflow/pull/12832
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55255
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255
• CISA KEV add notice: https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-55255