Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to anot…

CVE-2026-55255 is an authorization bypass through user-controlled key vulnerability affecting Langflow, an AI workflow builder. An authenticated attacker can execute any flow belonging to another user by specifying the victim's flow ID in the request, effectively bypassing authorization controls. This vulnerability allows lateral movement between user accounts within the same Langflow instance. The issue is tracked under GHSA-qrpv-q767-xqq2 on GitHub Security Advisories. CISA has included this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Organizations running Langflow are advised to apply patches immediately and review forensic triage requirements as outlined in the BOD 26-04 implementation guidance. The vulnerability is rated high criticality due to its potential for unauthorized access to sensitive AI workflows and data.