Sysdig Reports First Known In-the-Wild Exploitation of Langflow CVE-2026-55255

Summary

Sysdig says it observed the first known active exploitation of Langflow’s CVE-2026-55255 IDOR: an operator enumerated flow IDs and attempted to extract API keys while repeatedly trying CVE-2026-33017 RCE; the second-stage loader did not land.

Key points

Sysdig TRT reported observing an operator target the same internet-exposed Langflow instance with CVE-2026-55255 and CVE-2026-33017 on June 22 and June 25.
The operator queried /api/v1/flows/ for flow IDs, then used disclosed IDs at /api/v1/responses with the input “leak api keys”; the article does not establish that secrets were obtained.
The IDOR stems from a missing ownership check when a flow is resolved by UUID; the endpoint-name lookup enforces ownership. The flaw was fixed in Langflow 1.9.1.
The operator made repeated CVE-2026-33017 RCE attempts with shell commands to download and run a second-stage loader from 45.207.216.55:8084; Sysdig says the loader did not land.
Sysdig observed greater effort directed at the lower-scored, unauthenticated RCE than the 9.9 IDOR, which required authorization and a valid flow ID.
The report says the IDOR may be especially consequential in managed multi-tenant deployments, where it can cross tenant boundaries through the application layer; it recommends treating flow-ID disclosure as part of the IDOR attack surface.

Article Details

Attack Vectors: The operator enumerated flow IDs through GET /api/v1/flows/ and replayed them in POST /api/v1/responses to exploit the cross-tenant IDOR in CVE-2026-55255, using the input “leak api keys” to attempt to extract secrets from victim flows.
The operator exploited CVE-2026-33017 through Langflow’s /api/v1/build_public_tmp/…/flow endpoint, injecting shell commands that attempted to download and execute a second-stage payload.
The injected commands attempted to retrieve the payload with curl or wget and pipe it to sh; the article says the second stage never landed.
Defensive Notes: Update Langflow to version 1.9.1 or later to address CVE-2026-55255.
Review access controls on flow enumeration and ensure flow UUID lookups enforce ownership checks.
Prioritize remediation of CVE-2026-33017; the article reports widespread exploitation and notes that it is listed in CISA KEV.
For multi-tenant deployments, account for the IDOR’s ability to cross tenant boundaries through the application layer, even where RCE is sandboxed per tenant.
Use runtime detections for anomalous API activity and shell commands that download and execute payloads.

Indicators of compromise

Type	Indicator	Context
IPV4	`45[.]207[.]216[.]55`	Operator-controlled source and C2/staging host used for the attempted second-stage download.
URL	`hxxp[:]//45[.]207[.]216[.]55:8084/slt`	Second-stage loader URL targeted by the RCE payload; the article identifies it as hosted on the operator’s own host.