Langflow CVE-2026-55255 exploited in the wild
Help Net Security reported active exploitation of CVE-2026-55255, a CVSS 9.9 cross-tenant IDOR in Langflow, an AI-orchestration platform often deployed alongside MCP servers and agents.
The flaw is in the /api/v1/responses endpoint, which accepted a flow identifier from the client without checking that the caller owned it. An authenticated user could supply another tenant's flow ID and execute that flow, giving cross-tenant access to data and workflows. Sysdig observed exploitation in which an attacker enumerated flow IDs and then ran a flow with the prompt "leak api keys." CISA added the CVE to its Known Exploited Vulnerabilities catalog on July 7, 2026, and it was patched in Langflow 1.9.2.
Takeaway
An orchestration platform that holds long-lived provider keys next to multi-tenant data turns an authorization bug into wholesale key theft. Audit what your agent and MCP hosts store alongside tenant data, and separate credential storage from tenant-scoped execution.