CISA KEV First AI Agent Platform Entry — Langflow CVE-2026-55255 Let Any Authenticated User Execute Another User's Agent Flow With No Ownership Check; Fixed in 1.9.2; Federal Deadline July 10 Under BOD 26-04

CISA added CVE-2026-55255 to KEV on July 7, 2026 — first AI agent orchestration platform in the KEV. Langflow had no ownership check in flow dispatch, letting any authenticated user execute any other user's agent flow. Fixed in 1.9.2.

LangflowTool execution / MCPAuthorization bypass — cross-user agent flow execution with no ownership check (BOLA/IDOR)Multi-user Langflow deployments; agent flows with access to production databases, external APIs, file systems, CI/CD pipelines, or credentials

Permission Protocol read

Tool-Call GatePartialHigh

PP's Tool-Call Gate can enforce signed receipts on individual tool calls within a Langflow flow, requiring channel-authenticated approval from the flow owner before destructive or sensitive tool calls execute. An attacker triggering a victim's flow would fail to produce valid PP receipts from the victim's authenticated channel. However, PP does not prevent the unauthorized flow dispatch itself — it enforces at the individual tool-call boundary within the flow, not at the flow invocation layer.

Replay this incident with a signer in the loop

Most incidents are marked Partial because PP blocks actions routed through its gate. The key is placing the gate at the real action boundary.

Receipt would bind: actor, tool, action, resource, environment, approver, expiry.

What happened

An authenticated Langflow user sends a request to get_flow_by_id_or_endpoint_name with a victim user's flow ID. Langflow executes the flow without checking whether the requesting session user_id matches the flow's stored user_id. The attacker triggers the victim's agent flow — which may include database writes, API calls, file system access, or credential use — operating under the victim's configured permissions and tool access for the full duration of the execution.

Why it matters

Cross-user flow execution exposes all tool calls, credentials, database connections, API integrations, and data access configured in victim users' agent flows. In multi-user Langflow deployments, any authenticated account becomes a lateral movement vector against every other user's agent capabilities. CISA KEV listing confirms real-world exploitation — the vulnerability was weaponized before the public disclosure.

Missing authorization check

A per-request authorization check confirming that the requesting session user owns or has explicit permission to execute the requested flow, enforced before any tool calls fire. Langflow authenticated the user to the platform but never authorized the user for the specific flow being executed — authentication and per-object authorization were conflated.

Would PP block it?

CVE-2026-55255 lets an unauthorized user trigger another user's flow execution. In a PP-gated Langflow deployment, the attacker can still invoke the flow dispatch endpoint — PP's enforcement sits at the tool-call layer, not the flow-launch layer. However, consequential tool calls within that flow (database writes, file system access, API calls with credentials, code execution) will fail to produce valid PP receipts from the legitimate flow owner's authenticated channel, because the attacker's session cannot produce receipts on behalf of a different user. The uncovered window is the gap between flow dispatch and the first PP-gated tool call — any initialization logic or non-PP-gated tool calls in that window execute without PP coverage. Full protection requires PP to be positioned at the flow dispatch layer in addition to individual tool calls.

Incident analysis

Timeline and technical read

Timeline

2026-07-07
CISA adds CVE-2026-55255 to the Known Exploited Vulnerabilities catalog — the first AI agent orchestration platform CVE to appear in the KEV. Federal remediation deadline set for July 10, 2026 under BOD 26-04 (which replaced BOD 22-01 with variable, severity-based deadlines). CISA confirms active exploitation in the wild.
2026-07-07
Langflow 1.9.2 released with the ownership check fix: get_flow_by_id_or_endpoint_name now verifies that the stored flow user_id matches the requesting session user_id before executing the flow; mismatches return 404. The fix closes the BOLA gap at the dispatch layer.
2026-07-08
TechTimes and security media report on the CISA KEV entry, highlighting its significance as the first AI agent orchestration platform to be listed. Langflow now has three separate KEV-listed CVEs: CVE-2025-3248 (unauthenticated RCE), CVE-2026-5027 (path traversal RCE), and CVE-2026-55255 (authorization bypass).
2026-07-10
Federal BOD 26-04 remediation deadline. U.S. federal agencies running Langflow must apply the 1.9.2 patch or discontinue use per CISA directive.

Technical breakdown

CVE-2026-55255 is a classic Broken Object Level Authorization (BOLA / IDOR) vulnerability: Langflow's flow dispatch function accepted a flow ID from the requesting user and executed the corresponding flow without verifying the requesting session user_id against the flow's stored owner user_id. Authentication (valid session) was enforced; per-object authorization (permission to execute this specific flow) was absent.
The vulnerable function — get_flow_by_id_or_endpoint_name — is the central dispatch point in Langflow's flow execution path. The Langflow 1.9.2 fix adds a single ownership conditional at this function: if stored user_id ≠ session user_id, return 404. A one-line authorization check closes the cross-user execution gap for all flow invocation paths.
Impact scales with flow capability: Langflow flows can include database connectors (read/write), file system access, HTTP tool calls with stored credentials, Python code execution, and MCP server connections. An attacker executing a victim's flow inherits all configured capabilities for the full execution — the blast radius is determined by what the victim user's flow was designed to do.
CISA's KEV listing confirms active exploitation — real-world attackers identified and weaponized the missing ownership check before the CVE was publicly disclosed. The KEV listing for an AI agent orchestration platform is a milestone: it signals that AI workflow tools are now in the same threat intelligence tier as enterprise web applications, databases, and operating system components.
Langflow's KEV history now spans three CVEs: CVE-2025-3248 (unauthenticated RCE via /api/v1/validate/code, added to KEV 2025-05-01), CVE-2026-5027 (path traversal unauthenticated RCE), and CVE-2026-55255 (authorization bypass). Three KEV entries in an AI agent orchestration platform within 14 months is a strong indicator that Langflow instances are high-value, actively targeted attack surfaces.

Severity rationale

High

High: CVE-2026-55255 required only a valid authentication session to exploit — no elevated privileges, no admin access. Any authenticated Langflow user could trigger any other user's agent flow, inheriting all configured tool access, credentials, database connections, and API integrations for that flow's execution. CISA confirmed active exploitation in the wild and added to KEV with a 3-day federal remediation deadline under BOD 26-04. Not Critical because the initial entry point requires a valid session (unauthenticated access is a separate CVE class); however, chaining with unauthenticated Langflow vulnerabilities (CVE-2025-3248, CVE-2026-5027) raises effective impact to Critical in unpatched environments.

Team takeaway

Langflow's flow dispatch API had no ownership check — any authenticated user could execute any other user's agent flow and inherit all its tool access and credentials; CISA confirmed active exploitation and set a 3-day federal deadline; patch to Langflow 1.9.2.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at: Tool-Call Gate — individual agent tool calls within Langflow flows requiring signed receipts from the flow owner's authenticated channel; effective only after flow dispatch and before each sensitive tool call
Still needs: Flow-dispatch authorization enforcement (who may invoke a flow by ID, independent of tool-call gates); Langflow platform-level RBAC check before flow execution begins; initialization logic between flow dispatch and first PP-gated tool call
Receipt required for: Any Langflow flow execution triggering tool calls with production access, credential use, database writes, or external API calls — receipts must be issued through the flow owner's authenticated channel, not the requesting user's session

Lessons for teams

AI agent orchestration platforms must treat each flow as a distinct authorization scope. A valid session authorizes access to the platform — it does not implicitly authorize triggering any flow on the platform. Object-level authorization must be enforced at the flow dispatch layer, separate from platform-level authentication.
The CISA KEV listing of CVE-2026-55255 places AI agent platforms in the same security prioritization tier as traditional enterprise software. Security teams evaluating Langflow, Flowise, n8n, and similar orchestration tools should apply the same patching urgency frameworks they use for web application servers and database engines.
In multi-user Langflow deployments, a single compromised or malicious account becomes a lateral movement vector against every other user's agent capabilities — including flows with production database write access, external API credentials, and code execution. Blast radius in multi-user orchestration platforms scales with the average capability level of flows deployed.
Langflow's three KEV-listed CVEs within 14 months (unauthenticated RCE × 2, authorization bypass × 1) establish a pattern: this is an actively targeted platform. Any internet-exposed Langflow instance running pre-1.9.2 should be treated as potentially compromised, not merely vulnerable.
BOD 26-04's 3-day remediation deadline for federal agencies signals active, in-the-wild exploitation — not a theoretical risk. Organizations running Langflow with multi-user deployments should treat patching to 1.9.2 as P0 regardless of federal agency status.

Related incidents and controls

Critical2026-07-01

JADEPUFFER: First Confirmed Autonomous AI-Agent Ransomware — Exploited Langflow CVE-2025-3248 to Chain Credential Theft, Lateral Movement, and Irreversible Database Destruction Without a Human Operator

High2026-06-11

CVE-2026-5027 (CVSS 8.8): Langflow Path Traversal Allowed Unauthenticated Arbitrary File Write and RCE Across 7,000 Exposed AI Agent Pipelines

High2026-06-28

CVE-2026-33017 (CVSS 9.3): Unauthenticated RCE in Langflow Actively Exploited to Deploy Monero Cryptominer, Disable Security Controls, and Propagate via SSH on AI Agent Servers

Tool-Call Gate Why governance must be external

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop