Critical Actively exploited
CVE-2026-55255
Langflow Authorization Bypass Through User-Controlled Key Vulnerability
What this means
- Weakness
- Changing an identifier in the request grants access to another user’s data.
- Likelihood
- Exploitation is not hypothetical: CISA has observed it in the wild.
What to doTop priority: CISA sets the remediation deadline at 10 July 2026.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.