CVE-2026-55255: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Synopsis

An Insecure Direct Object Reference (IDOR) vulnerability affects Langflow, a platform for building and deploying AI-powered agents and workflows. The flaw exists in the `/api/v1/responses` endpoint and is reachable over the network by any authenticated user with a low-privilege account. A successful attacker can execute flows belonging to other users by simply substituting a victim's flow ID in the request, enabling unauthorized access to another user's data and workflows, as well as the ability to trigger or tamper with their AI flows. The description references a fix in version 1.9.2, but no official fix version has been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Langflow service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker only needs a valid authenticated session to submit requests to the `/api/v1/responses` endpoint.

• Victim interactionNot required

  No action from the victim is needed; the attacker directly references the victim's flow ID in a crafted API request.

• Attack complexityDetail

  The exploit is reliable and condition-free; substituting a target flow ID in a standard API request requires no special timing, memory layout knowledge, or environmental setup.

Blast Radius

• Reads the contents of another user's AI flows, potentially exposing proprietary logic, credentials, or sensitive data embedded in those workflows.
• Executes flows belonging to other users, which can trigger downstream actions such as API calls, data writes, or AI model invocations under the victim's identity.
• Modifies or disrupts another user's workflow execution by injecting or replaying flow runs, corrupting expected output state.
• The vulnerability carries a Scope:Changed rating, meaning a successful attacker can affect resources outside their own security boundary, extending impact beyond the directly compromised account.