CVE-2026-55255: Langflow IDOR Flaw Exploited to Steal AI Keys — And the First Agentic Ransomware Is Already Here

On July 7, 2026, CISA added four new entries to its Known Exploited Vulnerabilities (KEV) catalog. Three of them were perfect-10 remote code execution flaws — the kind of vulnerability that generates immediate headlines. The fourth, CVE-2026-55255 in Langflow, carried a CVSS score of just 6.1. It is the most strategically significant of the four.

That gap between impact and CVSS score reflects a recurring problem in how the industry thinks about AI platform vulnerabilities. CVE-2026-55255 allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request — a cross-tenant Insecure Direct Object Reference (IDOR). In a traditional web application, that is a serious but familiar finding. In an AI orchestration platform like Langflow, it is a credential store waiting to be emptied.

What Langflow Is and Why It Is Targeted

Langflow is an open-source framework for building, deploying, and managing AI workflows. It allows teams to connect large language models to tools, APIs, databases, and external services — all in one place. That makes it extraordinarily powerful. It also means that a typical production Langflow deployment contains LLM provider API keys, AWS and cloud credentials stored as environment variables, third-party API tokens, database connection strings, and the business logic powering AI-assisted operations.

Sysdig's threat research team observed a lone operator (IP 45.207.216.55) weaponising CVE-2026-55255 as part of a sustained campaign that ran from June 22 to June 25, 2026. The attack sequence was methodical: the operator began with authentication and reconnaissance, moved to flow enumeration, then used the CVE-2026-55255 IDOR to access flows belonging to other tenants. From those flows, the attacker extracted LLM provider API keys and AWS credentials.

"AI orchestration platforms are a trove of credentials in their own right, and this operator clearly knew it," Sysdig's Michael Clark observed. The RCE chain went after the host; the IDOR went after other tenants' flows and their keys. Both attack paths were executed in the same session.

The Technical Mechanics of CVE-2026-55255

CVE-2026-55255 is an authorisation bypass through a user-controlled key in Langflow. In practice, it means that when a logged-in user submits a request to execute a flow, the application does not adequately verify that the specified flow_id belongs to the requesting user's account. By substituting a victim's flow ID — obtainable via enumeration — the attacker executes the victim's flow and receives its output, including any credentials or data that flow processes or returns.

The vulnerability has a CVSS base score of 6.1, which undersells its real-world severity in multi-tenant deployments. The attacker does not need to break into the infrastructure at the operating system level; they simply need a valid account on the same Langflow instance. In SaaS deployments or shared Langflow infrastructure, this is a very low bar.

CISA's July 10, 2026, remediation deadline for Federal Civilian Executive Branch agencies signals that active exploitation in the wild is confirmed beyond the Sysdig-documented campaign. The deadline also means that patching should not wait for your next scheduled maintenance window.

CVE-2026-55255 in Context: A Langflow Track Record

It is worth understanding that CVE-2026-55255 is not an isolated incident. Over the past 14 months, Langflow has accumulated a significant CVE track record: CVE-2025-3248, CVE-2026-0770, CVE-2026-33017, CVE-2026-21445, CVE-2025-34291, CVE-2026-5027, and now CVE-2026-55255. The platform's surface area — combining user authentication, flow management, credential storage, and external API connectivity — makes it a persistent target for threat actors looking for high-value credential exfiltration opportunities.

The Sysdig campaign also demonstrated chaining: the same operator used CVE-2026-55255 alongside CVE-2026-33017, an unauthenticated RCE flaw in Langflow, with the two techniques complementing each other. The RCE delivered a second-stage downloader consistent with botnet and cryptojacking payloads. The IDOR delivered credential theft at the application layer. Together, they give the attacker both infrastructure control and persistent access to the victim's AI service accounts.

JADEPUFFER: The First Confirmed Agentic Ransomware

The most significant development in the Langflow threat landscape this week is not CVE-2026-55255 itself — it is what Sysdig documented just days earlier. In a July 2026 report, Sysdig described the first confirmed case of agentic ransomware: a human operator who deployed an artificial agent and provisioned the infrastructure needed for that agent to run an entire extortion operation autonomously from start to finish. This campaign has been codenamed JADEPUFFER.

JADEPUFFER exploited CVE-2025-3248, the earlier Langflow critical RCE, to gain the initial foothold. From there, the human operator configured and deployed an AI agent that autonomously handled reconnaissance, lateral movement, data staging, ransom note generation, and victim communication. The operator set the objective; the agent executed the operation.

The significance of JADEPUFFER cannot be overstated. Ransomware operations have historically been constrained by the availability of skilled human operators. Automation has enabled ransomware-as-a-service models, but each extortion campaign still required human decision-making at key points. JADEPUFFER represents a shift: a single operator can now delegate the operational complexity of a ransomware campaign to an autonomous AI agent, dramatically increasing the scale at which targeted extortion can be conducted.

Remediation Steps

If your organisation runs Langflow in any capacity — development, staging, or production — the following actions should be completed immediately.

First, update Langflow to the latest patched version that addresses CVE-2026-55255. Check the official Langflow release notes and apply the patch without delay; the CISA KEV deadline of July 10 has already passed, which means exploitation is actively occurring.

Second, audit your Langflow flows for stored credentials. Any LLM provider API key, cloud access credential, or database token stored within flows should be rotated immediately, regardless of whether you believe your instance was targeted. Credential rotation costs minutes; post-breach credential abuse costs significantly more.

Third, review access logs for the period June 22 to July 12, 2026, looking specifically for unusual flow execution patterns — particularly flows executed by users who do not normally interact with those flows, or flow executions originating from unfamiliar IP addresses.

Fourth, review your network exposure. Publicly accessible Langflow instances with no IP allowlisting or VPN requirement represent a material risk. If your Langflow deployment needs to be internet-accessible, enforce strong authentication, apply rate limiting, and segment the service from production credential stores wherever possible.

Finally, assess whether your AI orchestration platforms more broadly are included in your VAPT scope. The pattern across Langflow CVEs is consistent: AI platforms that handle credential-rich workflows are high-value targets and need to be tested with the same rigour applied to production APIs and authentication systems.

AI Platform Security as a VAPT Priority

Enforster AI, our AI-powered scanning engine, includes specific coverage for AI orchestration platforms, agentic workflows, and MCP-connected services. The JADEPUFFER campaign and the CVE-2026-55255 exploitation pattern demonstrate exactly why this coverage matters: vulnerabilities in AI platforms are not purely technical in nature — their impact is amplified by the credentials, workflows, and business logic they contain.

For organisations building on Langflow, Flowise, n8n, or similar AI orchestration platforms, we recommend a dedicated AI platform security assessment as part of your next VAPT engagement.

To discuss AI platform security testing or to schedule an assessment, contact us at [email protected] or visit /products/enforster-ai.

CVE-2026-55255 is a reminder that in AI orchestration platforms, a medium-severity IDOR is not a medium-severity business risk — and JADEPUFFER confirms that the threat actors who understand this are already acting on it.