--- title: CISA orders feds to prioritize patching Langflow auth... description: CISA has added CVE-2026-55255, an Insecure Direct Object Reference (IDOR) authentication bypass flaw in Langflow, to its Known Exploited Vulnerabilities... canonical: https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA orders feds to prioritize patching Langflow auth bypass flaw | daily.dev og:description: CISA has added CVE-2026-55255, an Insecure Direct Object Reference (IDOR) authentication bypass flaw in Langflow, to its Known Exploited Vulnerabilities... og:url: https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky og:image: https://api.daily.dev/og/posts/ozv7AxMky.png og:image:alt: CISA orders feds to prioritize patching Langflow auth bypass flaw og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA orders feds to prioritize patching Langflow auth bypass flaw **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary CISA has added CVE-2026-55255, an Insecure Direct Object Reference (IDOR) authentication bypass flaw in Langflow, to its Known Exploited Vulnerabilities catalog. Federal agencies have been ordered to patch by Friday under Binding Operational Directive BOD 26-04. The vulnerability allows authenticated attackers to access other users' AI flows, steal sensitive data, and consume compute resources. Sysdig's Threat Research Team first observed in-the-wild exploitation on June 25, with financially motivated attackers targeting compute resources and cloud credentials. This is the third Langflow vulnerability CISA has added to its KEV catalog in roughly a year, following a missing authentication RCE flaw in May 2025 and a code injection vulnerability in March 2026. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA orders urgent action on actively exploited Langflow RCE flaw](https://daily.dev/posts/cisa-orders-urgent-action-on-actively-exploited-langflow-rce-flaw-jioynjbkx) · BleepingComputer · 0 upvotes · 0 comments - [Understanding Langflow CVE-2026-55255, and why higher CVSS vulnerabilities aren't always the most exploited](https://daily.dev/posts/understanding-langflow-cve-2026-55255-and-why-higher-cvss-vulnerabilities-aren-t-always-the-most-ex-7dtqjt7o3) · Sysdig Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents) [View this post on daily.dev](https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA orders feds to prioritize patching Langflow auth bypass flaw","url":"https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky"},"datePublished":"2026-07-08T09:59:18.083Z","dateModified":"2026-07-08T09:59:38.510Z","description":"CISA has added CVE-2026-55255, an Insecure Direct Object Reference (IDOR) authentication bypass flaw in Langflow, to its Known Exploited Vulnerabilities...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3536228e363c291a8b5671c819f6c669?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3536228e363c291a8b5671c819f6c669?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-orders-feds-to-prioritize-patching-langflow-auth-bypass-flaw-ozv7axmky","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA orders feds to prioritize patching Langflow auth bypass flaw"}]} ```