cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

CISA Orders Federal Agencies to Patch Actively Exploited Langflow IDOR

· Original article ↗

Summary

CISA ordered U.S. federal agencies to patch actively exploited Langflow flaw CVE-2026-55255 by Friday. The IDOR can expose other users’ flows; Sysdig observed attacks targeting AI app servers.

Key points

  • CVE-2026-55255 is an IDOR that lets authenticated attackers access other users’ flows through the /api/v1/responses endpoint using a victim’s flow_id.
  • Successful exploitation can expose sensitive data processed by the flows and consume victim resources.
  • Sysdig reported observing in-the-wild exploitation on June 25, with attackers pursuing code execution and second-stage implant delivery; researchers described the activity as opportunistic and financially motivated.
  • CISA added CVE-2026-55255 to its Known Exploited Vulnerabilities Catalog and ordered U.S. federal civilian executive branch agencies to patch by Friday under BOD 26-04.
  • CISA also added Langflow flaws CVE-2025-3248 and CVE-2026-33017 to the catalog. Sysdig reported that the JadePuffer ransomware operation used CVE-2025-3248 to dump Langflow’s PostgreSQL database.
  • VulnCheck researcher Caitlin Condon reported active exploitation of a separate Langflow path traversal flaw, CVE-2026-5027, to write arbitrary files on exposed servers.

Article Details

Vulnerability Types
  • Insecure Direct Object Reference (IDOR) / authorization bypass
  • Missing authentication
  • Code injection
  • Path traversal
Severity
High for CVE-2026-5027; not specified for CVE-2026-55255
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unknown

CVE

CVE-2025-3248CISA also flagged earlier Langflow flaws, including CVE-2025-3248 and CVE-2026-33017, as well as a separate path traversal bug.CVE-2026-33017CISA also flagged earlier Langflow flaws, including CVE-2025-3248 and CVE-2026-33017, as well as a separate path traversal bug.CVE-2026-5027attackers have also been actively exploiting a high-severity Langflow path traversal vulnerability (CVE-2026-5027) to write arbitrary files on exposed servers, according to VulnCheck security researcher CaitlinCVE-2026-55255federal agencies to patch an actively exploited Langflow vulnerability, CVE-2026-55255, after researchers observed in-the-wild attacks targeting AI app servers.

People

Caitlin CondonVulnCheck security researcher cited as reporting active exploitation of the Langflow path traversal vulnerability.

Threat Actors

JADEPUFFERSysdig reported that the JadePuffer ransomware operation used CVE-2025-3248 to dump Langflow’s PostgreSQL database.

Vendors

Sysdig#LangflowVulnCheckpath traversal vulnerability (CVE-2026-5027) to write arbitrary files on exposed servers, according to VulnCheck security researcher Caitlin Condon.

Products

Langflowfederal agencies to patch an actively exploited Langflow vulnerability, CVE-2026-55255, after researchers observed in-the-wild attacks targeting AI app servers.

Countries

United StatesCISA ordered U.S. federal agencies to patch an actively exploited Langflow vulnerability, CVE-2026-55255, after researchers observed in-the-wild attacks targeting AI app servers.

Related Articles