{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0555",
  "aliases": [
    "CVE-2026-55255",
    "GHSA-qrpv-q767-xqq2"
  ],
  "related": [
    "PYSEC-2026-221"
  ],
  "published": "2026-06-19T00:00:00Z",
  "firstReported": {
    "date": "2026-06-19",
    "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2",
    "publisher": "Langflow (GitHub advisory)"
  },
  "modified": "2026-09-25T00:00:00Z",
  "summary": "Any authenticated user can run another user's flow on Langflow servers below 1.9.1 by passing the flow's UUID as the model on POST /api/v1/responses; exploited in the wild and in KEV.",
  "details": "## What\n\n`POST /api/v1/responses` takes a flow UUID in its `model` field, and `get_flow_by_id_or_endpoint_name` looked a flow up by UUID without checking `user_id`, so any authenticated user could run any other user's flow, reach data it processes and consume its owner's resources. Langflow's repository advisory scores it 9.9 (AC:L); the CVE record and GitHub's reviewed advisory score it 8.4 (AC:H), which this record follows. Sysdig reported the first known exploitation, seen on 2026-06-25, and CISA added the CVE to KEV on 2026-07-07. What that attacker told the hijacked flows to do is ACVE-2026-0556.\n\n## Detection\n\n`acve lock` does not inventory Python dependencies or Langflow deployments, so this record has no matcher: check `pip show langflow` and the server image tag by hand.\n\n## Fix\n\nUpgrade to 1.9.1.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow",
        "purl": "pkg:pypi/langflow"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-55255"
    },
    {
      "type": "FIX",
      "url": "https://github.com/langflow-ai/langflow/pull/12832"
    },
    {
      "type": "FIX",
      "url": "https://github.com/langflow-ai/langflow/commit/2c9f498d664a3c32698b57d7c5e752625291060e"
    },
    {
      "type": "FIX",
      "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.9.1"
    },
    {
      "type": "REPORT",
      "url": "https://www.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "auth-bypass"
      ],
      "cwe": [
        "CWE-639"
      ],
      "exposure": {
        "harness": {
          "value": "Langflow (PyPI langflow) below 1.9.1",
          "any": false,
          "status": "confirmed",
          "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2"
        },
        "model": {
          "value": "any",
          "any": true,
          "status": "confirmed",
          "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2"
        },
        "goal": {
          "value": "Any flow on the server that an authenticated caller names by its UUID",
          "stated": false,
          "status": "unconfirmed"
        },
        "tools": {
          "value": "POST /api/v1/responses, whose model field takes a flow UUID; get_flow_by_id_or_endpoint_name, whose UUID lookup did not check user_id",
          "status": "confirmed",
          "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2"
        },
        "approval": {
          "value": "No ownership check applies on the UUID lookup, so any authenticated caller's request runs the named flow",
          "mode": "none-required",
          "status": "confirmed",
          "source": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-qrpv-q767-xqq2"
        },
        "inputControl": "unknown",
        "agentAction": "Langflow runs another user's flow for any authenticated caller who passes that flow's UUID.",
        "harm": "harmful-action",
        "divergence": "none"
      },
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-25T00:00:00Z",
        "sources": [
          {
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-55255",
            "type": "kev",
            "note": "Added 2026-07-07, due 2026-07-10 (KEV JSON catalog 2026.09.25)."
          },
          {
            "url": "https://www.sysdig.com/blog/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-arent-always-the-most-exploited",
            "type": "research",
            "note": "Sysdig TRT saw one operator send two requests on 2026-06-25 that ran enumerated flows through POST /api/v1/responses; recorded as ACVE-2026-0556."
          }
        ],
        "kev": {
          "listed": true,
          "date_added": "2026-07-07",
          "due_date": "2026-07-10"
        }
      },
      "taxonomy": {
        "owasp_asi": [
          "ASI03"
        ],
        "atlas": [
          "AML.T0049",
          "AML.T0012"
        ]
      },
      "cveBoundary": "cve-aliased",
      "fix": {
        "summary": "Upgrade Langflow to 1.9.1 or later.",
        "actions": [
          {
            "type": "upgrade",
            "target": "pypi:langflow",
            "to": "1.9.1",
            "why": "First release with the fix (GHSA-qrpv-q767-xqq2, PR #12832).",
            "owner": "operator"
          }
        ]
      },
      "claims": [
        {
          "kind": "identifier",
          "statement": "Identifier CVE-2026-55255",
          "value": "CVE-2026-55255",
          "status": "confirmed",
          "source": "https://cveawg.mitre.org/api/cve/CVE-2026-55255",
          "result": "match",
          "observed": "CVE.org: PUBLISHED",
          "method": "machine",
          "checkedAt": "2026-09-25T18:36:12Z"
        },
        {
          "kind": "identifier",
          "statement": "Identifier GHSA-qrpv-q767-xqq2",
          "value": "GHSA-qrpv-q767-xqq2",
          "status": "confirmed",
          "source": "https://api.osv.dev/v1/vulns/GHSA-qrpv-q767-xqq2",
          "result": "match",
          "observed": "OSV: record found",
          "method": "machine",
          "checkedAt": "2026-09-25T18:36:12Z"
        },
        {
          "kind": "fixed-version",
          "statement": "Upgrade target 1.9.1",
          "value": "1.9.1",
          "status": "confirmed",
          "source": "https://api.osv.dev/v1/vulns/GHSA-qrpv-q767-xqq2",
          "result": "match",
          "observed": "OSV: fixed 1.9.1; affected-version 0.0.31; affected-version 0.0.32; affected-version 0.0.33; affected-version 0.0.40; affected-version 0.0.44; affected-version 0.0.45; affected-version 0.0.46; affected-version 0.0.52; affected-version 0.0.53; affected-version 0.0.54; affected-version 0.0.55; affected-version 0.0.56; affected-version 0.0.57; affected-version 0.0.58; affected-version 0.0.61; affected-version 0.0.62; affected-version 0.0.63; affected-version 0.0.64; affected-version 0.0.65; affected-version 0.0.66; affected-version 0.0.67; affected-version 0.0.68; affected-version 0.0.69; affected-version 0.0.70; affected-version 0.0.71; affected-version 0.0.72; affected-version 0.0.73; affected-version 0.0.74; affected-version 0.0.75; affected-version 0.0.76; affected-version 0.0.78; affected-version 0.0.79; affected-version 0.0.80; affected-version 0.0.81; affected-version 0.0.83; affected-version 0.0.84; affected-version 0.0.85; affected-version 0.0.86; affected-version 0.0.87; affected-version 0.0.88; affected-version 0.0.89; affected-version 0.1.0; affected-version 0.1.2; affected-version 0.1.3; affected-version 0.1.4; affected-version 0.1.5; affected-version 0.1.6; affected-version 0.1.7; affected-version 0.2.0; affected-version 0.2.1; affected-version 0.2.10; affected-version 0.2.11; affected-version 0.2.12; affected-version 0.2.13; affected-version 0.2.2; affected-version 0.2.3; affected-version 0.2.4; affected-version 0.2.5; affected-version 0.2.6; affected-version 0.2.7; affected-version 0.2.8; affected-version 0.2.9; affected-version 0.3.0; affected-version 0.3.1; affected-version 0.3.2; affected-version 0.3.3; affected-version 0.3.4; affected-version 0.4.0; affected-version 0.4.1; affected-version 0.4.10; affected-version 0.4.11; affected-version 0.4.12; affected-version 0.4.14; affected-version 0.4.15; affected-version 0.4.16; affected-version 0.4.17; affected-version 0.4.18; affected-version 0.4.19; affected-version 0.4.2; affected-version 0.4.20; affected-version 0.4.21; affected-version 0.4.3; affected-version 0.4.4; affected-version 0.4.5; affected-version 0.4.6; affected-version 0.4.7; affected-version 0.4.8; affected-version 0.4.9; affected-version 0.5.0; affected-version 0.5.0a0; affected-version 0.5.0a1; affected-version 0.5.0a2; affected-version 0.5.0a3; affected-version 0.5.0a4; affected-version 0.5.0a5; affected-version 0.5.0a6; affected-version 0.5.0b0; affected-version 0.5.0b2; affected-version 0.5.0b3; affected-version 0.5.0b4; affected-version 0.5.0b5; affected-version 0.5.0b6; affected-version 0.5.1; affected-version 0.5.10; affected-version 0.5.11; affected-version 0.5.12; affected-version 0.5.2; affected-version 0.5.3; affected-version 0.5.4; affected-version 0.5.5; affected-version 0.5.6; affected-version 0.5.7; affected-version 0.5.8; affected-version 0.5.9; affected-version 0.6.0; affected-version 0.6.0rc1; affected-version 0.6.1; affected-version 0.6.10; affected-version 0.6.11; affected-version 0.6.12; affected-version 0.6.14; affected-version 0.6.15; affected-version 0.6.16; affected-version 0.6.17; affected-version 0.6.18; affected-version 0.6.19; affected-version 0.6.2; affected-version 0.6.3; affected-version 0.6.3a0; affected-version 0.6.3a1; affected-version 0.6.3a2; affected-version 0.6.3a3; affected-version 0.6.3a4; affected-version 0.6.3a5; affected-version 0.6.3a6; affected-version 0.6.3a7; affected-version 0.6.4; affected-version 0.6.4a0; affected-version 0.6.4a1; affected-version 0.6.5; affected-version 0.6.5a0; affected-version 0.6.5a1; affected-version 0.6.5a10; affected-version 0.6.5a11; affected-version 0.6.5a12; affected-version 0.6.5a13; affected-version 0.6.5a2; affected-version 0.6.5a3; affected-version 0.6.5a4; affected-version 0.6.5a5; affected-version 0.6.5a6; affected-version 0.6.5a7; affected-version 0.6.5a8; affected-version 0.6.5a9; affected-version 0.6.6; affected-version 0.6.7; affected-version 0.6.7a1; affected-version 0.6.7a2; affected-version 0.6.7a3; affected-version 0.6.7a5; affected-version 0.6.8; affected-version 0.6.9; affected-version 1.0.0; affected-version 1.0.0a0; affected-version 1.0.0a1; affected-version 1.0.0a10; affected-version 1.0.0a11; affected-version 1.0.0a12; affected-version 1.0.0a13; affected-version 1.0.0a14; affected-version 1.0.0a15; affected-version 1.0.0a17; affected-version 1.0.0a18; affected-version 1.0.0a19; affected-version 1.0.0a2; affected-version 1.0.0a20; affected-version 1.0.0a21; affected-version 1.0.0a22; affected-version 1.0.0a23; affected-version 1.0.0a24; affected-version 1.0.0a25; affected-version 1.0.0a26; affected-version 1.0.0a27; affected-version 1.0.0a28; affected-version 1.0.0a29; affected-version 1.0.0a3; affected-version 1.0.0a30; affected-version 1.0.0a31; affected-version 1.0.0a32; affected-version 1.0.0a33; affected-version 1.0.0a34; affected-version 1.0.0a35; affected-version 1.0.0a36; affected-version 1.0.0a37; affected-version 1.0.0a38; affected-version 1.0.0a39; affected-version 1.0.0a4; affected-version 1.0.0a40; affected-version 1.0.0a41; affected-version 1.0.0a42; affected-version 1.0.0a43; affected-version 1.0.0a44; affected-version 1.0.0a45; affected-version 1.0.0a46; affected-version 1.0.0a47; affected-version 1.0.0a48; affected-version 1.0.0a49; affected-version 1.0.0a5; affected-version 1.0.0a50; affected-version 1.0.0a51; affected-version 1.0.0a52; affected-version 1.0.0a53; affected-version 1.0.0a55; affected-version 1.0.0a56; affected-version 1.0.0a57; affected-version 1.0.0a58; affected-version 1.0.0a59; affected-version 1.0.0a6; affected-version 1.0.0a60; affected-version 1.0.0a61; affected-version 1.0.0a7; affected-version 1.0.0a8; affected-version 1.0.0a9; affected-version 1.0.0rc0; affected-version 1.0.0rc1; affected-version 1.0.1; affected-version 1.0.10; affected-version 1.0.11; affected-version 1.0.12; affected-version 1.0.13; affected-version 1.0.14; affected-version 1.0.15; affected-version 1.0.16; affected-version 1.0.17; affected-version 1.0.18; affected-version 1.0.19; affected-version 1.0.19.post1; affected-version 1.0.19.post2; affected-version 1.0.2; affected-version 1.0.3; affected-version 1.0.4; affected-version 1.0.5; affected-version 1.0.6; affected-version 1.0.7; affected-version 1.0.8; affected-version 1.0.9; affected-version 1.1.0; affected-version 1.1.1; affected-version 1.1.2; affected-version 1.1.3; affected-version 1.1.4; affected-version 1.1.4.post1; affected-version 1.2.0; affected-version 1.3.0; affected-version 1.3.1; affected-version 1.3.2; affected-version 1.3.3; affected-version 1.3.4; affected-version 1.4.0; affected-version 1.4.1; affected-version 1.4.2; affected-version 1.4.3; affected-version 1.5.0; affected-version 1.5.0.post1; affected-version 1.5.0.post2; affected-version 1.5.1; affected-version 1.6.0; affected-version 1.6.1; affected-version 1.6.2; affected-version 1.6.3; affected-version 1.6.4; affected-version 1.6.5; affected-version 1.6.6; affected-version 1.6.7; affected-version 1.6.8; affected-version 1.6.9; affected-version 1.7.0; affected-version 1.7.1; affected-version 1.7.2; affected-version 1.7.3; affected-version 1.8.0; affected-version 1.8.0rc0; affected-version 1.8.0rc1; affected-version 1.8.0rc2; affected-version 1.8.0rc3; affected-version 1.8.0rc4; affected-version 1.8.0rc5; affected-version 1.8.0rc6; affected-version 1.8.1; affected-version 1.8.2; affected-version 1.8.3; affected-version 1.8.3rc0; affected-version 1.8.4; affected-version 1.9.0; CVE.org structured: lessThan 1.9.1; CVE.org description: fixed 1.9.1; PyPI: version exists",
          "method": "machine",
          "checkedAt": "2026-09-25T18:36:12Z"
        },
        {
          "kind": "installable",
          "statement": "Latest affected version 1.9.0 (below fixed 1.9.1) is still installable from PyPI",
          "value": "1.9.0",
          "status": "confirmed",
          "source": "https://pypi.org/pypi/langflow/1.9.0/json",
          "result": "match",
          "observed": "PyPI: version exists",
          "method": "machine",
          "checkedAt": "2026-09-25T18:36:12Z"
        },
        {
          "kind": "severity",
          "statement": "Severity HIGH (CVSS 8.4); matches CNA",
          "value": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "status": "confirmed",
          "source": "https://cveawg.mitre.org/api/cve/CVE-2026-55255",
          "observed": "CNA: HIGH 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L); OSV: HIGH 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L); OSV: HIGH 8.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)",
          "result": "match",
          "method": "machine",
          "checkedAt": "2026-09-25T18:36:12Z"
        }
      ],
      "severityBasis": "cvss",
      "reproducibility": {
        "status": "partial",
        "axesComplete": true,
        "componentsObtainable": true,
        "triggerPublished": false,
        "observableStated": true,
        "demonstrated": "vendor-confirmed",
        "missing": [
          "trigger not published"
        ]
      }
    }
  }
}