Federal Agencies Ordered to Patch Critical Langflow Vulnerability Amid Ongoing Exploitation
The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to prioritize patching a recently discovered vulnerability in the Langflow visual framework, which is used to build AI agents. This order comes as threat actors are actively exploiting the flaw to gain unauthorized access to sensitive data and resources.
Langflow is a popular tool among developers of artificial intelligence, offering a user-friendly interface to connect nodes into executable pipelines and a REST API for running them programmatically. Unfortunately, this ease of use has made it an attractive target for hackers. The currently exploited vulnerability, tracked as CVE-2026-55255, allows authenticated attackers to access other users’ flows by sending a maliciously crafted request to the /api/v1/responses endpoint with the victim’s unique identifier (flow_id).
The security flaw in question is an Insecure Direct Object Reference (IDOR) issue, which enables threat actors not only to access sensitive data processed by the victim’s flows but also to consume their resources. According to Sysdig’s Threat Research Team (TRT), the exploit was first observed in-the-wild on June 25, with the primary objective being code execution and delivery of a second-stage implant.
CISA has added CVE-2026-55255 to its Known Exploited Vulnerabilities Catalog (KEV) and ordered all US Federal Civilian Executive Branch (FCEB) agencies to secure their devices by Friday. The agency emphasized that this type of vulnerability poses significant risks to the federal enterprise, as it is a frequent attack vector for malicious actors.
This directive comes after CISA flagged two other Langflow vulnerabilities in recent months: CVE-2025-3248 and CVE-2026-33017. The latter was exploited by ransomware gangs to dump Langflow’s PostgreSQL database. Furthermore, attackers have been actively exploiting a high-severity path traversal vulnerability (CVE-2026-5027) since June.
The ongoing exploitation of these vulnerabilities underscores the importance of timely patching and vigilant monitoring of systems. As CISA warned, stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines. By prioritizing security and staying informed about emerging threats, organizations can minimize their risk of being compromised.
To stay ahead of attackers, it is crucial to regularly test every layer of your environment before they do. This includes conducting breach and attack simulation tests on your SIEM and EDR rules to ensure that potential threats are detected and addressed promptly.
Source: Bleeping Computer — 2026-07-08